Laserfiche WebLink
<br />Sample Government, FLORIDA <br /> <br />SCHEDULE OF FINDINGS AND QUESTIONED COSTS-FEDERAL A WARDS AND <br />STATE FINANCIAL ASSISTANCE PROJECTS <br />(Continued) <br /> <br />SECTION II - FINANCIAL STATEMENT FINDINGS (Continued) <br /> <br />. Backup and restoration functions for the Windows-based server environment are entirely <br />automated by Tivoli Storage Manager (TSM) which also decides which tapes should be sent <br />offsite. These decisions are made based on profiles within TSM, however, these profiles were <br />configured by consultants several years ago and are not fully documented by the Information <br />Technology staff. There is also no written backup policy or detail regarding the tape rotation <br />scheme. <br /> <br />. Formal procedures and policies do not exist that mandate the review and correction of daily <br />backup anomalies for the Windows-based server environment. As such, backup errors may not <br />be corrected in a timely manner, which may reduce the effectiveness of the backup system. <br /> <br />. The City has an agreement with SunGard to provide hardware support for the iSeries computer. <br />Once the City declares an emergency, iSeries operations can be moved to any of SunGard's hot- <br />sites throughout the country. The iSeries disaster recovery plan is generally tested every year, but <br />was not tested during this past year. <br /> <br />Effect <br /> <br />The lack of proper controls and procedures could have a negative impact on the City's electronic <br />information. <br /> <br />Cause <br /> <br />The cause is systematic in nature. <br /> <br />Recommendations <br /> <br />. The unauthorized installation of software may pose a risk to the City's network and information <br />security. The City should consider implementing a system for detecting and/or preventing the <br />installation of unauthorized software by individual users. <br /> <br />. The City should implement a system of policies and procedures for maintaining software license <br />compliance for desktop computers. A system could be as simple as a log of software purchased <br />and software installed. The record of software purchased and installed should be updated at least <br />yearly and any discrepancies corrected. <br /> <br />. Although TSM's is excellent for managing large and complex server environments, if the backup <br />configuration is not formally documented, it will not be possible to determine if backups are <br />functioning properly. The City should document, in detail, the configuration of the software and <br />hardware used to backup Windows-based servers. This documentation should be sufficient to <br />enable the City to recreate the configuration in the event of a disaster as well as verify that the <br />backup system is functioning according to policy. <br /> <br />4 <br />