Literature Review on Outsourcing and Risk Management

The provided assignment is a comprehensive literature review on the topic of outsourcing and risk management. The focus is particularly on the risks associated with Information Technology (IT) projects when outsourced. The literature review should encompass various aspects related to outsourcing risks, including security concerns, cultural and geographical differences between client and service provider organizations, performance management issues, and legal and contractual challenges.

Running head: CASE STUDY: COMPUTER OPERATIONS
Case Study- Computer Operations
Name of the Student
Name of the University
Author’s Note

1
CASE STUDY: COMPUTER OPERATIONS
Table of Contents
Introduction......................................................................................................................................2
1. Description of the services that the department provides to the organization.............................2
2. Type of disasters that will affect the department.........................................................................3
3. Preparation for a disaster situation..............................................................................................4
4. Risk analysis................................................................................................................................5
5. Need of contingency policy as well as plan.................................................................................7
6. Description of the requirement for starting contingency planning process.................................8
7. Description of business impact analysis and its components......................................................9
8. Discussion on the relationship between overall contingency planning and various subordinate
elements.........................................................................................................................................10
9. Description of the techniques used for data application and backup.........................................11
10. Description of the process that is used for organizing incident response planning process....12
11. Explanation of the techniques that can be employed when formatting a security incident
response team.................................................................................................................................13
12. Description of the processes used in making decisions about incident detection and escalation
.......................................................................................................................................................14
Conclusion.....................................................................................................................................14
References......................................................................................................................................15

2
CASE STUDY: COMPUTER OPERATIONS
Introduction
The paper focuses on a computer operation department of a large multinational
organization. It is identified that the computer operation department provides number of services
including outsourcing, product promotion, procurement as well as helps in handling online
database. It is identified that the organization wants to create a disaster recovery plan in order to
recover various types of data if any type of disaster associated with the company occurs.
In this paper, various types of disasters that can occur within the organization are
elaborated. The assignment also discusses disaster recovery plan, need of contingency policy as
well as business impact analysis. Moreover, the paper discusses the relationship between overall
contingency planning with various subordinate elements.
1. Description of the services that the department provides to the organization
The computer operation department provides number of services to the organization
which include:
Outsourcing: The department “Computer operations” provides outsourcing services to
the organization (Oshri, Kotlarsky & Willcocks, 2015). The department involves in outsourcing
various specific operations that helps in allowing them to withdraw or transfer their resources in
order to sell the associated assets.
Product promotion: The computer operation department involves in promoting the
products of the organization. It is identified that several strategies are utilized while promotion of

3
CASE STUDY: COMPUTER OPERATIONS
the products by the company. The company keeps it simple and helps in providing emphasizing
value over price so that the company does not have to participate in price war.
Supporting online database: Online database of the organization is supported by the
department of computer operations. It is identified that the department also helps in maintaining
the database of the clients on a daily basis (Sa Rocha & Cota, 2016). This assist in keeping up
the current client information for making changes that is necessary in the database.
Technical support: Technical support is provided by the computer operation department
in order to help the customers. The department helps in diagnosing the problems and helps the
customers in fixing their problem related with the product.
Monitoring: The departments provides proper supervision for security reasons and are
quite responsible of storing various types of items including files and more so that they can be
kept in a proper order and can be recovered whenever needed (Schondorf et al., 2017)
2. Type of disasters that will affect the department
The various type of disaster that will affect the department of “computer operations” are
provided below:
. Third party entry: It is identified that the cybercriminals generally prefer the path of
less resistance and as a result if proper authentication is not provided they can harm the
organization by stealing confidential information as well as data of department.
Security: The department does not have proper planning in order to maintain security
which creates a serious risk (Liu & Wang, 2016). It is identified that unsecured connection
vulnerability as well as number of security related disasters occur within the organization

4
CASE STUDY: COMPUTER OPERATIONS
Data theft: It is identified that deliberate attacks on the individuals as well as systems
that generally access the confidential data can cause harm (Griraa et al., 2015). The data breaches
create theft of sensitive data that can further create number of ethical issues.
Data loss: Due to improper storage facility, the data associated with the computer
operation department can be utilized by unauthorized people and as a result number of security
related disasters occurs within the organization.
Inadequate database support: The database support that is provided by the department
is not appropriate and as result the systems of the department can be accessed by unauthorized
users which can cause the issue related with data loss and data theft (Tajari, Valmohammadi &
Mohammadi, 2014). It is identified that the malicious use of the system also raises the chances
of disaster for the department of computer operations.
Loss of firewall protection: Due to loss of proper firewall protection, the department can
face number of disasters as well as issues related with computer crime as well as malicious use
of system. It is found that chances of unauthorized utilization will grow if the department does
not have proper firewall protection.
3. Preparation for a disaster situation
In order to prepare for the disaster situation, it is quite important to undertake the
activities or steps that are provided below:
Identification of disasters: The first step for the department of the computer operations
is to identify the disasters that can create risks for the company. If the disasters are identified
then it will be quite easier for the department to take proper mitigation steps.

5
CASE STUDY: COMPUTER OPERATIONS
Consider the impact: It is identified that a disaster has a devastating impact on the
workforce. If the impacts of the disasters are identified then it will be quite easier for them to
prioritize the disasters (Loke & Fung, 2014). Prioritizations of the disasters are quite significant
for minimizing the level of impact on the organization.
Creating plans and alerting staffs: The third step for the department is to create
appropriate plans that will be effective in resolving the problems associated with disasters. In
addition to this, the workforce of the department must be alerted so that they take proper action
for minimizing the security related disasters.
Finalize the disaster recovery plan: Proper training sessions must be arranged for the
staffs so that they can work out all the kinks long before the occurrence of the disaster (Chae et
al., 2014). Preventional training will be helpful in ensuring the workers to keep calm during the
time of stress.
Maintaining the plan: It is quite important for the company to revisits the disaster
recovery plan properly and remain vigilant for the changes in the policy of the company. Proper
steps must be prepared for both short and long term recovery for supporting the company.
4. Risk analysis
Risk Explanation Impact Frequency Mitigation
strategy
Inadequate
support of
database
The database
support that is
given is not
High Medium Proper database
support must be
provided so that

6
CASE STUDY: COMPUTER OPERATIONS
proper and as a
result
unauthorized
users get able to
access the
confidential
information that
will further
create risk for the
department.
unauthorized
users do not get
the access for
using the
sensitive
information of
the organization.
Third party
entry
It is identified
that the path of
less resistance is
mainly preferred
by the
cybercriminals
and as a result
they generally
enter through the
path that does is
not secure and
create risks for
the department of
Medium Medium Proper security
related measures
as well as proper
authentication
must be provided
so that the
organization does
not face any
issue or disaster
due to third
party.

7
CASE STUDY: COMPUTER OPERATIONS
computer
operations
Security Due to improper
security, data
theft as well as
data loss are the
two important
issue for the
department of
computer
operations as
data theft may
cause loss of
different
sensitive as well
as confidential
data of the
organization.
High High Proper security
related measures
must be taken in
order to avoid the
risks that are
associated with
data theft as well
as data loss.
5. Need of contingency policy as well as plan
The needs of contingency policy as well as plan are provided below:
Helps in improving relations: Contingency planning are very much significant for the
organization as it not only helps in maintaining the position of the company but also assists in

8
CASE STUDY: COMPUTER OPERATIONS
minimizing the risks that further avoids the chances of loss due to the disaster or the recovery
(Teller, Kock & Gemunden, 2014).
Help in reducing risks of uncertainty: If the performance does not work appropriately
then it is quite necessary for the organization to backup plans that will help in controlling the
situation in order to avoid various types of risks.
Improve continuity of work: It is identified that there are times, when both productions
as well as business are required to be stopped due to hindrances as well as presence of proper
factors including labor union, strike as well as shut down of machinery (Oels, 2013).
Prevents panic: If a disaster occurs within an company, then the people associated with
it panic. If a proper as well as appropriate contingency plan was created then the company can
easily control the situation in order to recover them. In addition to this, it is identified that
contingency planning helps in avoiding various types of risk so proper contingency plan must be
adopted for rapid growth.
6. Description of the requirement for starting contingency planning process
For starting the contingency planning the most important thing that is required is
elaborated below:
Knowledge for risk identification: The knowledge of risk identification is quite
important for identifying the risks that are associated with the department of computer operations
(Gielnik et al., 2014). It is quite important to identify the things that can go wrong within the
business.

9
CASE STUDY: COMPUTER OPERATIONS
Clear concept to analyze the impact of the risk: Clear concept is required in order to
analyze the impact of the risks. Proper training must be provided for analyze the risk impact and
prioritize the risks as per the level of impact.
Communication: Proper communication between the workers as well as higher authority
is required while creating the contingency planning (Schulze et al., 2016). Appropriate
contingency planning creation requires proper communication as well as advice.
Developing contingency planning policy: It is identified that a formal policy helps in
providing proper authority as well as guidance that is needed for developing an effective plan of
contingency.
7. Description of business impact analysis and its components
Business impact analysis is defined as a systematic procedure that helps in determining
as well as evaluating the potential impacts of an interruption due to various critical operations
due to the result of accident or emergency (Fleisher & Bensoussan, 2015). It is identified that
BIA is one of the essential for developing strategies component for an organization that generally
includes exploratory component for revealing vulnerabilities as well as different planning
component as well as minimizing different types of risks. It generally assists in predicting the
consequences of disruption of a business related function as well as process and mainly gathers
information for developing proper recovery strategies (Silvius & Schipper, 2014). Identification
as well as evaluation of the impact of disaster on the business generally helps in providing the
basis of investment in different recovery strategies as well as mitigation strategies.
The various component of business impact analysis are provided below:

10
CASE STUDY: COMPUTER OPERATIONS
Recovery time: The recovery time mainly helps in identifying time that is needed for
recovering different types of critical processes under various existing capabilities.
IT requirements: If proper electronic data is available then recovering specific
procedure to minimum level is required (Fisher & Rendahl, 2017).
Data backup history: If proper data source is identified than the old data can be
satisfactorily recovered.
Staffing minimums: It is quite important to identify various needs throughout the
recovery time objectives in order to optimize the recovery quite properly.
Impact level: Impact level helps in indicating impact of the various procedure on the
various mitigation measures (Fleisher & Bensoussan, 2015).
Likelihood level: It helps in indicating the likelihood level of the threat that is generally
occurred for the existing measures, as well as capabilities.
8. Discussion on the relationship between overall contingency planning and
various subordinate elements
The relationship between overall contingency as well as various subordinate elements are
illustrated below:
Incident response: It is found those non devastating threats as well as the steps of
mitigation as well as recovery helps in creating the relationship with the overall contingency
planning.

11
CASE STUDY: COMPUTER OPERATIONS
Business resumption: It is identified that risk ranking, business impact analysis,
recovery cost as well as mitigation steps are considered as the methods that helps in forming
proper relationship with the overall contingency planning (Ahimbisibwe, Cavana & Daellenbach,
2015).
Disaster recovery: It is found that both devastating threats as well as proper steps of
mitigation, respond as well as recovering helps in creating relationship with overall contingency
planning.
Business continuity planning: It is quite important to keep the operations running
during disaster recover as well as response (Saeed, Yousafzai & Engelen, 2014). It helps in
reflecting the relationship with the overall contingency plan.
9. Description of the techniques used for data application and backup
The different type of data and application backup as well as recovery technique are
illustrated below:
Disks or tape backup: This method or technique is considered as one of the oldest
technique of data backup (Saad, Natanzon & Dotan, 2015). In this method the backup of the
data is done on a physical device. Hard disk generally helps in offering faster as well as proper
backup as well as recovery plans.
Hybrid cloud backup: This method or technique mainly involves in backing up data on
a local device in a quite secure offsite center of data for redundancy. It is identified that this
practice is generally used for backing up data from the local device to a proper secure data
center.

12
CASE STUDY: COMPUTER OPERATIONS
Direct to cloud backup: By following this technique, all the data as well as applications
can be sent to the cloud. In this case the data or application is generally collected in a local data
center. It is dependent on the speed of the internet.
Recover from local service: This technique of recovery is only followed when the
device is locally present. This technique is considered as a great option if server failure has
occurred or any type of security related compromise is required.
Recover from cloud: It is found that some of the solution generally helps in
downloading backend data from the cloud which assists in transferring data with the help of
internet connection. If this technique is followed then the significant or important data can be
recovered from the cloud.
Recover right in the cloud: It is identified that if the local service is damaged then
some of the providers generally helps in spinning up a virtual machine directly in the cloud
which is mainly known as disaster recovery
10. Description of the process that is used for organizing incident response
planning process
The processes that can be used for organizing the incident response planning are
elaborated below:
Address issues of the business and assigning roles: The various issues as well as risks
that the business faces needs to be addressed and then significant rules are assigned to the
persons who are generally responsible of performing the task.

13
CASE STUDY: COMPUTER OPERATIONS
Identify the KPI: It is identified KPIs can be qualitative or quantitative. It is quite
important to identify the KPI properly as it generally helps in measuring the event.
Review plan: It is identified that IR plans must be reviewed frequently for providing
proper framework to operate with appropriate flexibility in order to handle the situation (Wang
et al., 2014). Proper review of the plan is quite necessary for handling the situation in a flexible
manner.
Determine incident: Determination of the incident is necessary in order to figure out
what should be acted ad what needs to be ignored. While ensuring the security team, it is quite
important to work on different serious issues.
Team formation: The formation of team is necessary as the incident response team will
involve in analyzing various reports of security breaches as well as threat intelligence for
developing as well as organizing incident response (Qu et al., 2014).
Implement right tools: It is identified that proper IR plan would mainly focus n the
visibility as well as understanding of the network. Proper communication will be helpful in
explaining the breach of the business for planning the remediation.
Establish communication strategy: Communication is considered as one of the
significant step for incident response planning (Kimball & Ross, 2013). Therefore having proper
communication strategy is very much necessary for alerting third parties.

14
CASE STUDY: COMPUTER OPERATIONS
11. Explanation of the techniques that can be employed when formatting a
security incident response team
The various types of techniques are employed while formatting security incident
response team. It is very much necessary to create some significant tools for authorized staff and
this tool generally includes collaborative websites as well as services of instant messaging that
helps in allowing users to exchange various types of information about different types of
technical projects as well as other work (Ruefle et al., 2014). It is identified that information
sharing as well as exchange services, technical exchanges and proper skill development
strategies are quite necessary. Assessment of incident response planning maturity as well as
capability requirements is necessary with critical infrastructure outreach for developing skill so
that the entire team can be formatted properly.
12. Description of the processes used in making decisions about incident
detection and escalation
It is identified that proper decision about incident detection as well as escalation can be
created by proper observations and by utilizing proper indicators. It is identified that the security
mechanism will help in identification. The team of incident handler will utilize the experience
for looking at the signs as well as indications of the incident as well as escalation. It is found that
the observation can occur at host level, system level or network level (Safi & Browne, 2017).
After proper identification it is very much important to access the level of impact. The accessing
the level of impact of risk is very much necessary in order to identify the level of damage it will
create or level of impact it will create and as per their level of impact, the identified risks are
generally prioritized.

15
CASE STUDY: COMPUTER OPERATIONS
Conclusion
It can be concluded from the entire assignment that proper disaster recovery planning is
very much necessary within the computer operation department of the organization. It is
identified that disaster recovery planning not helps in minimizing the level of damage that is
created. In this report, proper elaboration about contingency planning is provided. It is analyzed
that contingency planning is very much significant. The paper also discusses the techniques that
can be employed when formatting a security incident response team as well as for making
decisions about incident detection and escalation
References
Ahimbisibwe, A., Cavana, R. Y., & Daellenbach, U. (2015). A contingency fit model of critical
success factors for software development projects: A comparison of agile and traditional
plan-based methodologies. Journal of Enterprise Information Management, 28(1), 7-33.
Chae, J., Thom, D., Jang, Y., Kim, S., Ertl, T., & Ebert, D. S. (2014). Public behavior response
analysis in disaster events utilizing visual analytics of microblog data. Computers &
Graphics, 38, 51-60.
Fisher, B. A., & Rendahl, R. A. (2017). U.S. Patent No. 9,667,552. Washington, DC: U.S. Patent
and Trademark Office.
Fleisher, C. S., & Bensoussan, B. E. (2015). Business and competitive analysis: effective
application of new and classic methods. FT Press.
Gielnik, M. M., Barabas, S., Frese, M., Namatovu-Dawa, R., Scholz, F. A., Metzger, J. R., &
Walter, T. (2014). A temporal analysis of how entrepreneurial goal intentions, positive

16
CASE STUDY: COMPUTER OPERATIONS
fantasies, and action planning affect starting a new venture and when the effects wear off.
Journal of Business Venturing, 29(6), 755-772.
Griraa, J., Bédard, Y., Roche, S., & Devillersb, R. (2015). Towards a Collaborative Knowledge
Discovery System for Enriching Semantic Information about Risks of Geospatial Data
misuse. Uncertainty Modelling and Quality Control for Spatial Data, 233.
Kimball, R., & Ross, M. (2013). The data warehouse toolkit: The definitive guide to dimensional
modeling. John Wiley & Sons.
Liu, S. & Wang, L. (2016).Influence of managerial control on performance in medical
information system projects: the moderating role of organizational environment and team
risks. International Journal of Project Management, 34(1), pp.102-116.
Loke, A. Y., & Fung, O. W. M. (2014). Nurses’ competencies in disaster nursing: implications
for curriculum development and public health. International journal of environmental
research and public health, 11(3), 3289-3303.
Oels, A. (2013). Rendering climate change governable by risk: From probability to contingency.
Geoforum, 45, 17-29.
Oshri, I., Kotlarsky, J., & Willcocks, L. P. (2015). The Handbook of Global Outsourcing and
Offshoring 3rd Edition. Springer.
Qu, Z., Rastogi, V., Zhang, X., Chen, Y., Zhu, T., & Chen, Z. (2014, November). Autocog:
Measuring the description-to-permission fidelity in android applications. In Proceedings
of the 2014 ACM SIGSAC Conference on Computer and Communications Security (pp.
1354-1365). ACM.

17
CASE STUDY: COMPUTER OPERATIONS
Ruefle, R., Dorofee, A., Mundie, D., Householder, A. D., Murray, M., & Perl, S. J. (2014).
Computer security incident response team development and evolution. IEEE Security &
Privacy, 12(5), 16-26.
Sá, F., Rocha, Á.& Cota, M.P. (2016). From the quality of traditional services to the quality of
local e-Government online services: A literature review. Government Information
Quarterly, 33(1), pp.149-160.
Saad, Y., Natanzon, A., & Dotan, Y. (2015). U.S. Patent No. 9,152,578. Washington, DC: U.S.
Patent and Trademark Office.
Saeed, S., Yousafzai, S. Y., & Engelen, A. (2014). On cultural and macroeconomic
contingencies of the entrepreneurial orientation–performance relationship.
Entrepreneurship Theory and Practice, 38(2), 255-290.
Safi, R., & Browne, G. (2017). Information Seeking Behavior in the Domain of Security Incident
Detection: An Experimental Investigation.
Schondorf, S.Y., Kleve, R.B., Van Wiemeersch, J.R., Patel, D.B., Bennie, B. & Swadling, G.,
Ford Global Technologies, Llc. (2017). Methods and systems for monitoring the
condition of vehicle components from a nomadic wireless device or computer. U.S.
Patent 9,715,665.
Schulze, M., Nehler, H., Ottosson, M., & Thollander, P. (2016). Energy management in
industry–a systematic review of previous findings and an integrative conceptual
framework. Journal of Cleaner Production, 112, 3692-3708.