The organization is moving its customer portal to an infrastructure-as-a-service platform. When updating the disaster recovery plan, what should the information security manager ensure FIRST?
Select an answer to reveal the explanation.
Short Explanation
In the cloud, recovery is a group project, and group projects go wrong when nobody knows who's doing what. Before anything else, you pin down which recovery tasks belong to the provider and which belong to you. Assuming the provider handles everything is the trap; in IaaS, a lot of it is still on your side.
Full Explanation
Moving to infrastructure as a service shifts some recovery responsibilities to the provider, typically the physical facilities and underlying infrastructure, while the organization usually remains responsible for its virtual machines, configurations, data, backups and the design of resilient deployments. The first step in updating the disaster recovery plan is to define and document that division, using the provider's documentation and the contract, so the plan's procedures cover everything the organization must do. Certification of the provider's data centers offers assurance about its controls but does not transfer responsibility for recovering the customer's workloads, which remain the customer's in an IaaS model. Copying on-premises procedures unchanged ignores the different recovery mechanisms, dependencies and contacts of a cloud environment and may describe steps that are no longer possible. Excluding cloud workloads because of an availability commitment confuses availability of the provider's service with recovery of the organization's data and systems; an availability guarantee does not restore a deleted database or a misconfigured deployment. Exam caveat: responsibility splits differ between IaaS, PaaS and SaaS, so each service should be considered separately. Operational check: confirm a responsibility matrix exists for the portal and that each customer-side task has a procedure and an owner in the plan.