London, 21^st January, 2010—Imperva, the leader in Data Secur­ity, announced today the release of study ana­lyz­ing 32 million pass­words recently exposed in the Rockyou.com breach.  Imperva’s Applic­a­tion Defense Center (ADC) ana­lyzed the strength of the pass­words in a report, Con­sumer Pass­word Worst Prac­tices, that ana­lyzes 32 million pass­words to help con­sumers and website admin­is­trat­ors identify the most com­monly used pass­words they should avoid when using social net­work­ing or e-commerce sites.

The report can be down­loaded at:  http://www.imperva.com/ld/password_report.asp (regis­tra­tion not required).

The report iden­ti­fies the most com­monly used passwords:

• 123456
• 12345
• 123456789
• Pass­word
• iloveyou
• prin­cess
• rockyou
• 1234567
• 12345678
• 10.  abc123

“Every­one needs to under­stand what the com­bin­a­tion of poor pass­words means in today’s world of auto­mated cyber attacks: with only minimal effort, a hacker can gain access to one new account every second—or 1000 accounts every 17 minutes,” explained Imperva’s CTO Amichai Shulman.  “The data provides a unique glimpse into the way that users select pass­words and an oppor­tun­ity to eval­u­ate the true strength of pass­words as a secur­ity mech­an­ism.  Never before has there been such a high volume of real-world pass­words to examine.”

Some key find­ings of the study include:

• The short­ness and sim­pli­city of pass­words means many users select cre­den­tials that will make them sus­cept­ible to basic forms of cyber attacks known as “brute force attacks.”
• Nearly 50% of users used names, slang words, dic­tion­ary words or trivial pass­words (con­sec­ut­ive digits, adja­cent key­board keys, and so on). The most common pass­word is “123456”.
• Recom­mend­a­tions for users and admin­is­trat­ors for choos­ing strong passwords.

For enter­prises, pass­word insec­ur­ity can have serious con­sequences.  “Employ­ees using the same pass­words on Face­book that they use in the work­place bring the pos­sib­il­ity of com­prom­ising enter­prise systems with insec­ure pass­words, espe­cially if they are using easy to crack pass­words like ‘123456’,” said Shulman.

“The problem has changed very little over the past 20 years,” explained Shulman, refer­ring to a 1990 Unix pass­word study that showed a pass­word selec­tion pattern similar to what con­sumers select today.  “It’s time for every­one to take pass­word secur­ity ser­i­ously; it’s an import­ant first step in data security.

Imperva will host a webinar detail­ing the study’s find­ings.  To register, please sign up here: https://imperva.webex.com/imperva/onstage/g.php?d=792179849&t=a&SourceID=004

BS25999 is a stand­ard that estab­lishes the process, prin­ciples and ter­min­o­logy of busi­ness con­tinu­ity management.The stand­ard deals with broad goals and is there­fore non pre­script­ive so as to make it applic­able to small and large busi­ness and local or global organisations.

The stand­ard aims to achieve the following

• Provides a basis for under­stand­ing busi­ness con­tinu­ity management
• Provides a means of meas­ure­ment that is con­sist­ent and recognised
• Provides a system based on estab­lished good practice

It does not deal in general with emer­gency plan­ning and man­age­ment except in the context of an organ­isa­tions role within a larger civil emergency.

• Is the stand­ard for me?
• If I have a busi­ness con­tinu­ity man­age­ment plan already in place, why should I use this standard?
• Is it just for large organisations?
• Is it com­plic­ated and going to tie me up in red tape?
• Is it just a British Stand­ard, not rel­ev­ant if I live in the USA?

The stand­ard was pre­pared by BSI Tech­nical Com­mit­tee BCM/1 whose mem­ber­ship included rep­res­ent­at­ives from the fin­an­cial ser­vices industry, gov­ern­ment, aca­demia, the emer­gency ser­vices, busi­ness organ­isa­tions and a number of spe­cial­ist prac­ti­tion­ers from around the world.

It has been designed to be applic­able to all sizes and types of organ­isa­tions as the broad prin­ciples and prac­tices described can be adapted to suite each indi­vidual organ­isa­tion, con­sid­er­able flex­ib­il­ity exists in imple­ment­a­tion of the stand­ard Although many industry sectors have a mature busi­ness con­tinu­ity cap­ab­il­ity, many do not, par­tic­u­larly small to medium business.

Having a non pre­script­ive, mod­er­ately easy to under­stand and con­sist­ent set of prin­ciples will enable busi­ness con­tinu­ity to mature in a greater number of businesses.

BSi have delivered a stand­ard for the needs of the British market but it is just as applic­able in New York or Munich as it is in London.

Of course, com­ply­ing with the stand­ard does not infer any immunity from prob­lems, this must be under­stood clearly by any organ­isa­tions looking to use it but lays down a common frame­work that will ulti­mately enable meas­ure­ment, bench­mark­ing and certification.

Meas­ure­ment, bench­mark­ing and cer­ti­fic­a­tion will provide market assur­ance that the organ­isa­tion is well pre­pared to meet a range of events that may threaten its sus­tain­ab­il­ity and existence.

BS 25999 is a busi­ness con­tinu­ity man­age­ment stand­ard developed by BSI and is used by busi­nesses glob­ally. The Depart­ment of Home­land Secur­ity (DHS) has announced its intent to adopt BS 25999 (which comes in two parts) on a trial basis as one of three stand­ards for use in the Vol­un­tary Private Sector Pre­pared­ness Accred­it­a­tion and Cer­ti­fic­a­tion Program (PS-Prep). PS-Prep is dir­ec­ted by Title IX of the Imple­ment­ing the Recom­mend­a­tions of the 9/11 Com­mis­sion Act of 2007.

PS-Prep sets out to enhance nation­wide resi­li­ence by improv­ing private sector pre­pared­ness to estab­lish a common set of cri­teria for private sector pre­pared­ness, includ­ing dis­aster man­age­ment, emer­gency man­age­ment and busi­ness con­tinu­ity pro­grams. Cer­ti­fic­a­tion to BS 25999 US Edition will be used to confirm com­pli­ance with the vol­un­tary pre­pared­ness scheme.

Todd Vander­Ven, Pres­id­ent of BSI Americas,said:

“We are delighted to support the PS-Prep with the pro­vi­sion of BS 25999 US Edition. The stand­ard has been used suc­cess­fully by private busi­nesses around the world assist­ing organ­iz­a­tions of all types and size determ­ine and invest in crit­ical areas of the organ­iz­a­tion, protect repu­ta­tion and enhance stake­holder con­fid­ence. It will now play a key role for private sector organ­iz­a­tions in the USA wishing to demon­strate com­pli­ance with the vol­un­tary pre­pared­ness scheme.”

Every year thou­sands of busi­nesses face the risk of a dis­rup­tion to their busi­ness oper­a­tions, ranging from the effects of every­day dis­rup­tion such as power failure, to adverse weather con­di­tions to full scale ter­ror­ist attacks. Busi­ness inter­rup­tions can create a chain of ‘knock-on’ effects stretch­ing as far as dam­aging national and inter­na­tional infra­struc­ture. The need for good guid­ance in this field has never been stronger.

BS 25999 US Edition sets out the require­ments for estab­lish­ing and main­tain­ing an effect­ive BCM system, effect­ively enabling an organ­iz­a­tion to anti­cip­ate and prepare for dis­rup­tion. This might mean being able to rapidly recruit tem­por­ary staff or moving premises at very short notice: risks are dif­fer­ent for every organ­iz­a­tion but BS 25999 US Edition helps the organ­iz­a­tion to determ­ine what they are and make the neces­sary arrange­ments. Inde­pend­ent cer­ti­fic­a­tion to this stand­ard enables an organ­iz­a­tion to demon­strate to cus­tom­ers, stake­hold­ers and legis­lat­ors its pro­act­ive approach to achiev­ing best prac­tice in the area of BCM.

BS 25999 US Edition is ini­tially avail­able to private busi­nesses in the US for a one month period. At the end of this, all public com­ments on the stand­ard will be examined and the DHS will eval­u­ate the stand­ard for per­man­ent use in the program.

Selec­tion of the BSI Stand­ard does not imply DHS endorse­ment of BSI or any of its products or ser­vices other than the par­tic­u­lar stand­ard to be used for limited purposes.

For more inform­a­tion on BS 25999 US Edition,visit the BSI website.

www.bsiamerica.com

Anyone who tells you that your IT network is “100% secure” is either a fool, or greatly mis­taken. Secur­ity is a moving target, and unfor­tu­nately, this target is being manip­u­lated by the bad guys.

• Forget the rear­view mirror: The bad guys are ahead of you
• Leave the lights on — always
• Don’t forget the boiling oil! Your mom was right: change your under­wear, often
• Don’t let vendors put you in their box

Forget the Rear View Mirror

You may not know the intent of those attack­ing your systems; however what you should know is that they prob­ably know more than you. The secur­ity industry does not innov­ate; we simply chase behind the true innov­at­ors and try to keep up.

Zero-day attacks and unknown vul­ner­ab­il­it­ies. Malware and botnets. There is no magic crystal ball to tell you what’s coming next, but you need to be looking to secure your future.

Looking in the rear­view mirror you will see invest­ment in network con­trols that stop simple mass attacks. But the attack­ers have evolved and “moved up the stack” going after applic­a­tions and host systems with tar­geted attacks. Com­mer­cial and custom soft­ware that run on these hosts contain thou­sands of vul­ner­ab­il­it­ies. Using simple, widely-known tech­niques, hackers can exploit these vul­ner­ab­il­it­ies and easily gain com­plete access to the hosts.

It always will be import­ant to keep current with the latest patches to remedi­ate vul­ner­ab­il­it­ies. However, the lag time between dis­cov­ery of a vul­ner­ab­il­ity and an exploit is rapidly dwindling.

Zero-day (and zero-hour!) attacks are a reality: you are hit before you even know there is a problem. This renders tra­di­tional signature-based, react­ive pro­tec­tion inad­equate. A pro­act­ive pro­tec­tion stance is now neces­sary. What I mean by this: you need to find ways to apply com­pens­at­ing meas­ures to shield vul­ner­ab­il­it­ies imme­di­ately. This will buy your organ­iz­a­tion the time needed to wait to receive, test and soak the patch appro­pri­ately before deploying.

As the threats con­tinue to evolve, we need to evolve our con­trols, and the mind­sets behind them.

Leave the lights on — always

TJX has become a house­hold brand, for all the wrong reasons. The UK Foreign and Com­mon­wealth Office was just slapped for endan­ger­ing the privacy and iden­tit­ies of people apply­ing for visas to enter the UK.

Secur­ity is about vigil­ance. You need to leave the lights on, or in other words, do everything you can to dis­suade attack­ers by making it dif­fi­cult for them to attain their goal. You don’t have to be perfect; you just have to be a little bit more secure than the neigh­bour, as attack­ers will go after easier targets first.

You need to recog­nize that the new age of inform­a­tion tech­no­logy tools means that the average secur­ity levels in soft­ware is going down. It was hard enough to find applic­a­tion developers who under­stood secur­ity, but now we see web applic­a­tions built by ama­teurs using script­ing lan­guages, and you can appre­ci­ate the problem. In the web 2.0 world, these applic­a­tions execute across fire­wall bound­ar­ies, opening more seams for clever attack­ers to exploit.

A mistake made by one, has con­sequences for all.

Don’t forget the boiling oil!

Defence-in-depth works. Castles his­tor­ic­ally had strong peri­meter defences, but the buckets of boiling oil were on standby to dis­cour­age attack­ers that got past the moat and drawbridge.

Tra­di­tional peri­meter defences for our net­works are neces­sary, but now not suf­fi­cient. There are so many ways to get though the peri­meter. An attack might ori­gin­ate from an end user lured to a mali­cious site com­prom­ised by malware. The res­ult­ing down­loaded malware tunnels in through the HTTP session, ready to launch exploits from within your network peri­meter. More fre­quent use of encryp­tion is prob­lem­atic, as it can blind network scan­ning tools, and be a nice tunnel for malware to enter the enterprise.

Secur­ity pro­fes­sion­als, and indeed most busi­ness exec­ut­ives, fun­da­ment­ally accept the basic premise that it takes mul­tiple layers of defence to protect against the wide variety of attacks and threats. A single product or secur­ity layer is not suf­fi­cient. A layered, defence-in-depth approach gives mul­tiple lines of defence that will allow one product to catch things that may have slipped past the outer defences.

Learn from the past to secure the future.

Your mom was right: change your under­wear, often

Let’s talk about what “vigil­ance” in secur­ity really means. Reg­u­la­tions are popping up in every industry and country or region around the world. When it comes to secur­ity, much of these reg­u­la­tions, in par­tic­u­lar pre­script­ive reg­u­la­tions such as PCI, are advan­cing secur­ity in leaps and bounds.

The problem with these reg­u­la­tions is how we (organ­iz­a­tions col­lect­ively) are dealing with them. Offi­cial audits cause mad panic as we rush to apply all secur­ity patches and con­trols to comply with reg­u­la­tions. Shortly there­after, com­pla­cency and for­get­ful­ness allow con­trols to lapse and patches to be avoided.

Com­pli­ance is more than just for the aud­it­ors; it will help protect your busi­ness. But, com­pli­ance does not equal secur­ity. Only you can be respons­ible to keep your house in check.

Don’t let vendors put you in their box

This is not about think­ing “outside the box” unless of course you use these as code words for saying “works with more than just Microsoft.” One of the most common com­plaints that we have heard from CIOs and CISOs around the world is the pre­val­ence of Microsoft-fanatical vendors — even worse, those that support sin­gu­lar ver­sions of Microsoft products.

Look for secur­ity vendors and products that work (well) across the broad­est range of plat­forms. There are extremely varied opin­ions on the secur­ity of open source oper­at­ing systems and applic­a­tions, but regard­less, you should not let a vendor tell you how to run your busi­ness when you are asking them how to secure your business.

You need to be wary of vendors that claim to provide a “one-stop shop” for all things secur­ity. There is sig­ni­fic­ant value in a diversity of secur­ity approaches to match the diversity of approaches to malware and other forms of attacks.

Secur­ity needs to be able to be deployed where and when you need it. As embar­rass­ing as it sounds, this fun­da­mental fact seems to have been for­got­ten by the major­ity of secur­ity vendors around the world. The fork­lift approach to secur­ity install­a­tion does not work when you are pro­tect­ing mission crit­ical systems. Secur­ity mech­an­isms need to com­ple­ment exist­ing systems and should not disrupt your business.

Great secur­ity + poor deploy­ment = bad security

Good secur­ity + good deploy­ment = great security

Looking to the future

From London, to Frank­furt, or even Beijing, the secur­ity game being played has new players and new purpose. Today’s cyber­crim­in­als are organ­ized, ruth­less, and fin­an­cially or polit­ic­ally motiv­ated. Your best line of defence is a defence-in-depth approach to security.

Make sure you choose vendors (not vendor) that are willing to chase your attack­ers as much as they chased you for your business.

Brian O’Higgins, CTO for leading intru­sion defence firm, Third Brigade, is best known for his role intro­du­cing PKI products to the secur­ity land­scape. http://www.thirdbrigade.com/

BS25999-2:2007 requires a Busi­ness Con­tinu­ity Man­age­ment System (BCMS) be imple­men­ted, main­tained and improved.

An organ­isa­tions busi­ness con­tinu­ity pro­gramme is defined in a man­age­ment system, termed the Busi­ness Con­tinu­ity Man­age­ment System or shortened to BCMS (sorry, another acronym to learn)

The general require­ment of the stand­ard is that the organ­isa­tion, fairly obvi­ously, devel­ops, imple­ments, main­tains and improves a busi­ness con­tinu­ity man­age­ment system in line with famil­iar the PLAN-DO-CHECK-ACT model.

PLAN: Estab­lish busi­ness con­tinu­ity policy, object­ives, targets, con­trols, pro­cesses and pro­ced­ures.
DO: Actu­ally get on an imple­ment ones plans
CHECK: Monitor and review per­form­ance against object­ives and policy
ACT: Take pre­vent­at­ive and cor­rect­ive actions to ensure con­tinu­ous improvement

Estab­lish and Manage the BCMS [PLAN]

This section requires that the organ­isa­tion defines its busi­ness con­tinu­ity require­ments in terms of its overall object­ives and that the scope of the BCMS is clearly defined, for example is it just for the London office or the whole organisation.

In what is a poten­tially large task it also requires that the organ­isa­tion assures itself, by whatever demon­strable method, that it’s key sup­pli­ers and out­sourced agen­cies also have effect­ive BCM in place. Prob­ably the easiest way to demon­strate that sup­pli­ers have effect­ive busi­ness con­tinu­ity is to require them to have BS25999, a some­what dif­fi­cult task to com­plete admit­tedly. Other means might include inspec­tions, ques­tion­naires etc

The BCMS must as a minimum contain;

* A busi­ness con­tinu­ity policy
* Respons­ib­il­it­ies
* Man­age­ment Pro­cesses
* Topic Spe­cific Pro­cesses
* Documentation

A BCM policy is required that demon­strates com­mit­ment and details the scope and object­ives of the BCMS. This policy also has to be reg­u­larly reviewed and made avail­able to all rel­ev­ant parties. Very similar to a quality policy or secur­ity policy this forms the found­a­tion of the BCMS because it demon­strates clear man­age­ment com­mit­ment and sets out responsibilities.

The organ­isa­tion has to demon­strate that an appro­pri­ate level of resources are alloc­ated and that a person is nom­in­ated to be account­able and for implementation/maintenance of the BCMS. This does not have to be the same person and in larger organ­isa­tions means that a senior manager, perhaps a Board member is account­able but a Busi­ness Con­tinu­ity Manager is respons­ible for imple­ment­a­tion and maintenance.

Any person who is assigned respons­ib­il­it­ies in the BCMS also has to have appro­pri­ate com­pet­ency. There also has to be doc­u­mented evid­ence to support this. How organ­isa­tions choose to demon­strate com­pet­ence is up to them and might include inter­view notes, pro­fes­sional qual­i­fic­a­tions, ref­er­ences, train­ing records, tests, copies of pub­lished work or a mix of various items. Of course with a nod to the various pro­fes­sional organ­isa­tions out there one of the quick­est ways to demon­strate com­pet­ence would be to have copies of their pro­fes­sional qual­i­fic­a­tions on file.

Train­ing and com­pet­ency man­age­ment for those involved in the BCMS either by virtue of their day to day role or involve­ment in a recov­ery or incid­ent is required.

Embed­ding Busi­ness Con­tinu­ity Man­age­ment in the Organ­isa­tions Culture
BCM has to become a central part of its man­age­ment outlook and an ongoing BCM edu­ca­tion and inform­a­tion pro­gramme must be in place.

Busi­ness Con­tinu­ity Man­age­ment Systems Doc­u­ment­a­tion and Records
The doc­u­ment­a­tion that forms part of the BCMS has to be fully con­trolled and pro­tec­ted by doc­u­ment release and author­isa­tion processes

As a minimum the BCMS­must contain the fol­low­ing documentation

* Scope
* Policy
* Resource pro­vi­sion
* Staff com­pet­ency and records
* BIA, risk assess­ment and BC strategy
* Incid­ent response structure,incident response plan and busi­ness con­tinu­ity plan
* Exer­cise arrange­ments
* Main­ten­ance, review and audit pro­ced­ures
* Pre­vent­at­ive and cor­rect­ive actions
* Man­age­ment reviews and evid­ence of con­tinual improvement

Record man­age­ment, in order to support the Plan Do Check Act model forms a key part of the stand­ard, for example, reten­tion, loc­a­tion, author­isa­tion, issue status etc

The BCMS doc­u­ment­a­tion may be main­tained in hard copy or soft copy formats.

Imple­ment and Operate BCMS [DO]

Get out there and put those plans into action.

Under­stand the Organ­isa­tion
This section essen­tially form­al­ises what is in Part 1; that is carry out a BIA in a struc­tured and doc­u­mented manner record­ing the results. Using a doc­u­mented risk assess­ment process the organ­isa­tion shall analyse the threats it faces and vul­ner­ab­il­it­ies to those threats, these being meas­ured against its crit­ical activ­it­ies and resources. The, decide how the organ­isa­tion is going to address those risks. One of the key ele­ments of this section is that the risk assess­ment process must be doc­u­mented so again organ­isa­tions can simply doc­u­ment how they do it or just use a recog­nised method and refer to that in their BCMS.Once the organ­isa­tion is under­stood in terms of impacts, risks and like­li­hoods a reas­on­able strategy can be decided upon.

Develop and Imple­ment a BCM Response
Once a strategy has been decided upon, imple­ment it. This also includes the incid­ent response structure.

Exer­cising and Main­tain­ing BCM Arrange­ments
When the BCM response has been imple­men­ted it has to be tested with an exer­cise pro­gramme that is appro­pri­ate for the organisation.

Monitor and Review the BCMS [CHECK]

To ensure that the BCMS is effect­ive a mon­it­or­ing and review process shall be implemented.

Broadly split into 2 elements

Internal Audit
If the organ­isa­tion already has an internal audit func­tion it may make sense to utilise the pro­cesses and pro­ced­ures already being used. Even per­son­nel not spe­cific­ally trained in busi­ness con­tinu­ity may be used as internal audit should be an object­ive process.

Man­age­ment Review
Man­age­ment review would ordin­ar­ily be an annual exer­cise involving review of internal and external audit activ­ity, resources and other inputs and outputs. The overal object­ive of the man­age­ment review is to determ­ine if the the BCMS con­tin­ues to meet the organ­isa­tions needs. A man­age­ment review may also take place in light of sig­ni­fic­ant organ­isa­tional change.

Main­tain and Improve the BCMS [ACT]

One of the goals of any man­age­ment stand­ard is that of con­tinu­ous improvement.

The stand­ard requires that organ­isa­tions con­tinu­ally improve the general effect­ive­ness of the BCMS with a mixture of both pre­vent­at­ive and cor­rect­ive actions. Pre­vent­at­ive and cor­rect­ive actions are iden­ti­fied by a range of activ­it­ies such as audits, event ana­lysis or man­age­ment reviews. They have to be form­ally recor­ded and acted upon and these records held for inspection.

The man­age­ment review will determ­ine a range of actions that need to be taken.

BS25999 Part 2 is a Spe­cific­a­tion, not a Code of Prac­tice like Part 1. So what is the dif­fer­ence? Part 2 is a Spe­cific­a­tion and deals with ‘Shall’ rather than ‘Should’ as the Part 1 Code of Prac­tice does.

Titled BS 25999–2:2007 Spe­cific­a­tion for busi­ness con­tinu­ity man­age­ment and includes…

* Doc­u­ment­a­tion Require­ments
* Man­age­ment respons­ib­il­ity
* Internal BCMS Audit
* Man­age­ment review of BCMS
* BCMS Improvement

The stand­ard was pub­lished on Novem­ber 20^th 2007

How does an organ­isa­tion seek com­pli­ance with the standard?

As with most man­age­ment stand­ards the process will be rel­at­ively stand­ard­ised using the guidelines in ISO 17021

STEP 1 — Application

Apply to a cer­ti­fic­a­tion body, cer­ti­fic­a­tion bodies are organ­isa­tions that are accred­ited to certify organ­isa­tions, for example BSI or LRQA (although these two examples are not the only ones). An under­stand­ing of the scope of the BCMS will need to be made. The cer­ti­fic­a­tion body will then create a pro­posal detail­ing the number of assess­ment days required and costs etc. If the organ­isa­tion chooses to proceed the assess­ment should take place.

STEP 2 — Pre Assessment

A pre assess­ment may be used to provide a snap shot of read­i­ness for the full assess­ment. Sampling and other tech­niques may be used in this pre assess­ment. Any areas of omis­sion will be raised and an assess­ment of remedial work, should any be needed, would be made. The formal assess­ment may be delayed if it is thought that it would be unlikely that the organ­isa­tion would pass.

STEP 3 — Assessment

The formal assess­ment is then made during which all areas of the Part 2 Spe­cific­a­tion will be covered. In line with ISO17021 and in a similar way to other man­age­ment stand­ards the formal assess­ment is done in two parts.

Stage 1: This stage will cover the Busi­ness Con­tinu­ity Man­age­ment System and will examine BCMS doc­u­ment­a­tion, the man­age­ment review/audit system and eval­u­ation of read­i­ness for stage 2. Plan­ning for Stage 2 will also take place.

Stage 2: This stage exam­ines the imple­ment­a­tion of the BCMS i.e. object­ive evid­ence. It may involve inspec­tion of records, inter­views of per­son­nel and phys­ical inspections.

Any obser­va­tions or non con­form­it­ies will be form­ally recor­ded and a recom­mend­a­tion for cer­ti­fic­a­tion or not made.

STEP 4 - Recom­mend­a­tion and Award

If client achieves recom­mend­a­tion for cer­ti­fic­a­tion body this recom­mend­a­tion will be for­war­ded to the BS25999 Cer­ti­fic­a­tion Manager for final review and issuing of cer­ti­fic­ates. If the client fails the audit a cor­rect­ive action plan is usually agreed and a second audit arranged.

STEP 5 — Con­tin­ued Assessment

When the cer­ti­fic­ate has been awarded sur­veil­lance audits will be planned, typ­ic­ally at yearly inter­vals. These sur­veil­lance visits will examine the effect­ive­ness of the BCMS, man­age­ment reviews/audit, pro­gress of con­tinual improve­ment actions, change review and pos­sibly the use of the regis­tra­tion marks in pub­li­city mater­i­als etc. A full reas­sess­ment will also be carried out at longer inter­vals, usually 3 years although this will depend on both the organ­isa­tion and the cer­ti­fic­a­tion body.

What are the bene­fits of certification?

As I have men­tioned the stand­ard comes in two parts. Split­ting them is designed to make it easier to under­stand and deploy. Part 2 or the Spe­cific­a­tion sets out the minimum that an organ­isa­tion should do in order that its busi­ness con­tinu­ity systems are effective.

Imple­ment­ing BS25999 Part 1 or the Code Prac­tice will undoubtedly provide many bene­fits to an organ­isa­tion but there is no doubt that achiev­ing cer­ti­fic­a­tion will require sig­ni­fic­ant extra work, so what are the benefits?

In a word, demonstrability.

Having cer­ti­fic­a­tion to a known and accep­ted man­age­ment stand­ard such as BS25999 Part 2 avoid saying to stake­hold­ers ‘Trust Me’

Writing and testing a dis­aster recov­ery plan is one of the key ele­ments of busi­ness con­tinu­ity man­age­ment. Tra­di­tion­ally busi­ness con­tinu­ity and dis­aster recov­ery (DR) plan­ning have always been sep­ar­ated between the busi­ness and the inform­a­tion tech­no­logy (IT) department.

It has long been recog­nised that this “divide” creates more prob­lems that it solves, after all most busi­nesses could not con­tinue to operate suc­cess­fully if their IT ser­vices were unavail­able for a period of time, depend­ing on the nature of your busi­ness this may well range from a few hours to several days.

The launch of BS 25999 has estab­lished a Busi­ness Con­tinu­ity Man­age­ment (BCM) stand­ard which intrins­ic­ally links BCM, Incid­ent Man­age­ment, and IT DR. Essen­tially the key message is to have true busi­ness con­tinu­ity you must also have strong capability.A dis­aster recov­ery plan should inter­face with the overall busi­ness con­tinu­ity man­age­ment plan, be clear and concise, focus on the key activ­it­ies required to recover the crit­ical IT ser­vices, be tested reviewed and updated on a regular basis, have an owner, and enable the recov­ery object­ives to be met.

Recov­ery Objectives

The two key recov­ery object­ives which many people are famil­iar with are: the recov­ery time object­ives, how long can my busi­ness con­tinue to func­tion without the crit­ical IT ser­vices (how quickly must I recover the service from the “decision to invoke”) the recov­ery point object­ive, from what time in my pro­cessing cycle am I going to recov­ery my data (how much data am I pre­pared to lose or have to re-enter from an altern­ate source).

There are several options, these are:

* Zero data loss, recov­ery to the point of failure
* Start of the current busi­ness day (SoD)
* End of the pre­vi­ous busi­ness day (EoD)
* Intraday

Intra­day is a point between the last avail­able backup either SoD or EoD and the failure, for argu­ments sake midday period end, the weekly or monthly backup

Addi­tion­ally there is an addi­tional measure, this is the Maximum Tol­er­able Outage (MTO), the MTO is the maximum time that my busi­ness will survive from the initial service interruption.

The recov­ery object­ives must be based upon solid busi­ness require­ments iden­ti­fied by the Busi­ness Impact Ana­lysis (BIA) process.

This figure above clearly demon­strates the cor­rel­a­tion between the incid­ent start­ing, the report­ing process, the invest­ig­a­tion process, the decision making process, and the recov­ery process. If the MTO is 12 hours and the IT DR process takes 8 hours to perform from the invoc­a­tion point then the decision to invoke has to be made within 4 hours of the initial incident.

Knowing this “lead time” is crucial to imple­ment­ing an effect­ive incid­ent man­age­ment and escal­a­tion process. The recov­ery time object­ive is where most mis­un­der­stand­ing occurs between the Busi­ness and IT Department.

The message from IT to the Busi­ness is “of course we can recover ser­vices within your required recov­ery time”.

The hidden message is assum­ing we start the recov­ery imme­di­ately the incid­ent in detec­ted. Gen­er­ally speak­ing many organ­isa­tions usually recover from minor incid­ents or service inter­rup­tion well within their MTO.

The fol­low­ing diagram gives a high level incid­ent man­age­ment and DR invoc­a­tion flow:

Dis­aster Recov­ery Plan Objectives

The key object­ive of a dis­aster recov­ery plan is to detail the key activ­it­ies required to rein­state the crit­ical IT ser­vices within the agreed recov­ery object­ives. The most effect­ive start point for any DR plan is the “Declar­a­tion of a Dis­aster” once an incid­ent has been deemed serious enough that “forward fixing” at the primary loc­a­tion is imprac­tical or is likely to result in an outage expend­ing beyond the Maximum Tol­er­able Outage.

There are a number of common mis­takes which organ­isa­tion make when cre­at­ing a DR plan, these relate to the level of detail they contain and the “stan­dalone” nature of their construction.

So what level of detail should the plan contain?

The answer will depend on who you ask, the more people you ask the varied number of replies you will receive. It is advis­able to keep the IT DR plan as concise as pos­sible and focus only on the key inform­a­tion required at the time of a disaster.

So what inform­a­tion should the DR plan contain?

As a minimum the plan should contain the fol­low­ing information:

A state­ment detail­ing the scope and cap­ab­il­ity of the DR Plan, exactly when should this plan be used and what “con­sequences” are covered. It is advis­able to focus on the con­sequences of an incid­ent rather than the cause.

Why focus on con­sequences rather than the cause?

It is really import­ant why the data centre is des­troyed? As far as the DR Plan is con­cerned the answer is no. The same process and recov­ery stages will be fol­lowed regard­less of the cause, fire, flood, ter­ror­ist incid­ent, or the pro­ver­bial air­craft impact will all result in the partial or total destruc­tion of the data centre.

The only rel­ev­ant ques­tion is what is the impact and can I real­ist­ic­ally con­tinue to host ser­vcies from my primary site or should I invoke and recover/resume the crit­ical ser­vices at my sec­ond­ary site.

A descrip­tion of the key roles and respons­ib­il­it­ies so that anyone assigned to a par­tic­u­lar role in the recov­ery team under­stand what is required of them. Should you name indi­vidu­als in the plan? Ideally indi­vidu­als who are to be expec­ted to perform a par­tic­u­lar role should already be aware that they are likely to be called upon and should have received the rel­ev­ant train­ing. It is advis­able to record the names and contact details of indi­vidu­als in the rel­ev­ant section of the overall BCM plan rather than the DR Plan. There is no reason why the indi­vidual names at the time can’t be entered into the recov­ery log as the “des­ig­nated recov­ery manager” or other pre­defined role.

A summary of the crit­ical ser­vices, their recov­ery object­ives and recov­ery pri­or­it­ies, this inform­a­tion may be lifted from the Busi­ness Impact Ana­lysis (BIA) per­formed as part of the overall BCM process. Sum­mar­ising them in the invoc­a­tion plan will remove the inev­it­able dis­cus­sions at the time of the incid­ent and provide a ref­er­ence point for the recov­ery teams. Third party contact details, par­tic­u­larly those that may be required to assist in the recov­ery effort or those that provide recov­ery ser­vcies, for example:

The sec­ond­ary (DR) data centre service pro­vider, you will need contact details, address, maps, and of course the invoc­a­tion process and codes. It is advis­able to do this as soon as it becomes clear the incid­ent is likely to become a dis­aster recov­ery situ­ation. You can always “stand down” if the incid­ent can be forward fixed (some service pro­viders may levy a charge for this);

Your media hand­ling company. Are your dis­aster recov­ery tapes removed from your data centre and vaulted off-site? If so you will want to arrange for them to be retrieved and sent to your recov­ery centre at the earli­est oppor­tun­ity; Mobil­isa­tion of the recov­ery teams.

What teams and indi­vidu­als need to be con­tac­ted to recov­ery the ser­vices, at this stage of the recov­ery the incid­ent man­age­ment team will already know the extent of the incid­ent and should (if not you need to make sure you do at the earli­est oppor­tun­ity) have placed the recov­ery teams on standby.

The plan should teams and skills required, not indi­vidu­als. Indi­vidual contact details have to be recor­ded some­where, it is normal prac­tice, as part of the overall busi­ness con­tinu­ity man­age­ment program to have “contact lists”, rather than repeat the detailed contact inform­a­tion the DR Plan should ref­er­ence the rel­ev­ant sec­tions in the BCM plan.

Detailed recov­ery activ­it­ies and sequence of events, includ­ing pre-requisites, depend­en­cies, and responsibilities.

What level of detail should you include in this section of the DR Plan?

This is very much down to per­sonal choice, however, as a minimum you should include:

The recov­ery process and flow of activities;high level activ­it­ies, for example, load oper­at­ing systems, install applic­a­tion soft­ware, restore data, syn­chron­ise data­base, make con­fig­ur­a­tion changes, post recov­ery checks, open service to users; pre-requisites and depend­en­cies for each activ­ity; respons­ib­il­it­ies, who will perform each activity.

Should you include the detailed activ­it­ies for installing an oper­at­ing system or restor­ing a data­base? The detailed recov­ery activ­it­ies should be held locally by the team respons­ible for per­form­ing these activ­it­ies. There are several reasons for this, the “how do I install Windows” instruc­tions will be used for busi­ness as usual activ­it­ies, minor incid­ents, and dis­aster recov­ery. The DR Plan only needs to ref­er­ence these doc­u­ments, if you find it an abso­lute neces­sity to include these in your DR Plan then do so as an appen­dices and not in the main body of the doc­u­ment, don’t allow key purpose of the DR Plan to be lost in un-necessary or duplic­ated detail.

Testing the Dis­aster Recov­ery Plan

IT DR Testing should be per­formed on a regular basis, the exact fre­quency very much depends on your own organ­isa­tional needs. However, it is usual for “full deploy­ment” tests should be per­formed, as a minimum, on an annual basis. There are of course other “trigger points”, for example, a change in your infra­struc­ture that affects your dis­aster recov­ery strategy, i.e. moving from active/contingency recov­ery model to an active/passive recov­ery model.

What do I test?

This ques­tion is prob­ably the most common ques­tion asked, and the answer is simple, you test the plans, the process, the people, and the infra­struc­ture, in fact every com­pon­ent required to recov­ery and resume your crit­ical IT services.

What are the key object­ives of a DR test? There are several key object­ives of a test, the main ones are:

Exer­cise the recov­ery pro­cesses and pro­ced­ures famil­i­ar­ise staff with the recov­ery process and doc­u­ment­a­tion; verify the effect­ive­ness of the recov­ery doc­u­ment­a­tion; verify the effect­ive­ness of the recov­ery site; estab­lish if the recov­ery object­ives are achiev­able; identify improve­ments require to the DR strategy, infra­struc­ture, and recov­ery processes;

What is the scope of a DR test?

The scope will very much depend on the matur­ity of your DR strategy and cap­ab­il­ity, it is import­ant to scope the test to stretch the object­ives and success cri­teria of the pre­vi­ous test, for example, if this is your first test, you may not want to have the entire user com­munity sched­uled to come in and perform lots of testing, you may wish to limit the scope to just IT staff and maybe a couple of “friendly users” to test func­tion­al­ity. Depend­ing on the com­plex­ity of your envir­on­ment it may take several tests to build con­fid­ence and perform a “full deploy­ment” test.

Common DR testing mis­takes are:

Oper­at­ing within your comfort zone, for example, recov­er­ing the servers you know you can recov­ery whilst avoid­ing the more dif­fi­cult components

Not testing the recov­ery of a service but focus­ing on the hard­ware, systems, and applic­a­tions. Remem­ber, a par­tic­u­lar service may require several servers to be recovered, it may also require data held on local drives and network attached devices, and network con­nectiv­ity from the data centre to the user. trying to achieve too much too soon and over­stat­ing your DR cap­ab­il­ity and readiness

Not plan­ning appro­pri­ately, testing and live invoc­a­tion are very dif­fer­ent. In a live invoc­a­tion you do not have a live envir­on­ment to protect. Con­sider the impact that testing may have on your live services.

Engage with the appro­pri­ate people at an early stage, a “full deploy­ment” test may take several weeks to plan.

Siemens Enter­prise Com­mu­nic­a­tions Limited

Ever­sheds have pub­lished a guid­ance doc­u­ment on the Human Resources implic­a­tions for pan­demic planning.

While the recent media report­ing of swine flu has dwelt on the obvious health and safety issues, the threat of a pan­demic, whether now or in the next few months, also raises some prac­tical chal­lenges for HR depart­ments across the country.

Neces­sary action steps?

From a health and safety per­spect­ive, employ­ers are legally required to provide a safe working envir­on­ment, and this includes pro­tect­ing employ­ees from out­breaks of con­ta­gious dis­eases in the work­place. However, how that pro­tec­tion might be afforded is likely to give rise to many and diverse issues for employ­ers and that is assum­ing employ­ees can make it in to work. What if public trans­port is affected and schools closed, pre­vent­ing attend­ance at work?

The key message is to be pre­pared, to take sens­ible pre­cau­tions now and to have a con­tin­gency plan in place in case the situ­ation deteri­or­ates. Such a plan should reflect a bal­anced and informed risk assessment.

Some initial sens­ible pre­cau­tions include:

Provid­ing employ­ees with access to the latest gov­ern­ment inform­a­tion and advice via emails, posters and the like

Advising unwell employ­ees to seek medical advice and to stay away from work

Restat­ing absence report­ing pro­ced­ures to ensure that employ­ees report their illness at the earli­est opportunity

Post­pon­ing face to face meet­ings and train­ing courses or repla­cing them with tele­con­fer­en­cing; can­cel­ling unne­ces­sary travel and social events.

Con­tin­gency Planning

A con­tin­gency plan will address the more dif­fi­cult HR and legal issues. For example, it should anti­cip­ate the following:

How the organ­isa­tion could con­tinue to func­tion with a skel­eton staff, for example, divid­ing work between mul­tiple sites in case one loc­a­tion is affected

Whether and how to train more employ­ees in essen­tial business-critical know­ledge and skills, to ensure the organ­isa­tion can con­tinue to operate

How to manage working hours and over­time where employ­ees agree to cover absent employees

How to deal with employ­ees who are required to go on business-critical foreign travel, but who refuse to go for fear of getting infected

Whether essen­tial foreign busi­ness travel can be tracked to allow employ­ees to be located and repat­ri­ated if necessary

How to deal with foreign-posted employ­ees who want to come home

How and when employ­ees will be per­mit­ted to work from home to avoid work­place infection

Where home-working is not an option, how the organ­isa­tion will deal with employ­ees being excluded from an infec­ted work­place. Is there a con­trac­tual right to lay-off employ­ees, or to require them to attend a dif­fer­ent work­place or take holiday in such circumstances?

Whether the employer has the right to require employ­ees to submit to a medical examination

How to deal with employ­ees who are well but who are refus­ing to attend work to avoid the risk of general infection

Whether the employer has the right to require an employee to submit to a vac­cin­a­tion against swine flu (if one is developed)

Whether and how normal absence record­ing will include quar­ant­ine time, working from home to avoid infec­tion and falling ill with swine flu (one risk being that employ­ees are ‘pen­al­ised’ for report­ing symptoms)

How to deal with employ­ees whose depend­ants fall ill with swine flu or where their children’s school is closed to contain an infection.

Many of these issues rep­res­ent organ­isa­tional and staff­ing issues for the employer. Others, such as how to address lack of attend­ance, work­place clos­ures and what, if any, pay­ments absent employ­ees should receive can be legally complex.

How an employer should respond will vary accord­ing to the par­tic­u­lar issue and, unfor­tu­nately, there is no one-size-fits-all answer. A start­ing point will be the con­tract of employment.

For example, if a work­place is required to close tem­por­ar­ily, the con­tract may provide for enforced holiday or lay-offs. If employ­ees cannot attend work because of their per­sonal cir­cum­stances or travel facil­it­ies, there is unlikely to be a spe­cific con­trac­tual term address­ing this.

Con­sid­er­a­tion will then need to be given to issues such as the employee’s right to stay at home to under­take emer­gency child­care, flex­ible working and home-working policies and any custom and prac­tice within the organisation.

Like­wise, con­sider custom and prac­tice in the context of occu­pa­tional sick pay; the risk being that this has become a con­trac­tual right for employees.

Where employ­ers have no con­trac­tual terms address­ing poten­tial pan­demic issues, the employee may agree to unpaid leave and other changes to their con­tract. Seeking employee consent to short-term changes in terms and con­di­tions to deal with an emer­gency is a poten­tial option worth exploring.

Con­tin­gency plan­ning requires the employer to act reas­on­ably, weigh­ing up the needs of both the employer and employee and con­sult­ing with trade unions or employ­ees rep­res­ent­at­ives, if appro­pri­ate, before decid­ing on policy.

In so doing, employ­ers must treat employ­ees even-handedly, for example, not making unfun­ded assump­tions around preg­nant, older or dis­abled employ­ees. Employ­ers should also be aware of privacy and data pro­tec­tion issues when dealing with the details of employ­ees’ ill­nesses or other sens­it­ive per­sonal information.

Contact us

To find out more about the Ever­sheds train­ing courses and other human resources issues, please e-mail hrgroup@eversheds.com. You can also visit our train­ing pages for details of in-house and public courses.

As power costs soar and the demand for power in data centres grows saving energy is always going to be high on the to do list for man­agers, users and owners. Gartner have release an in depth report showing how to save up to 1 million kilo­watt hours per year.

The main areas for best prac­tice improve­ments are;

Plug holes in the raised floor: Most raised-floor envir­on­ments exhibit cable holes, conduit holes and other breaches that allow cold air to escape and mix with hot air. This single low-tech ret­ro­fit can save as much as 10 percent of the energy used for data centre cooling.

Install blank­ing panels: Any unused pos­i­tion in a rack needs to be covered with a blank­ing panel to manage airflow in a rack by pre­vent­ing the hot air leaving one piece of equip­ment from enter­ing the cold-air intake of other equip­ment in the same rack. When the panels are used effect­ively, supply air tem­per­at­ures are lowered by as much as 22 degrees Fahren­heit, greatly redu­cing the elec­tri­city con­sumed by fans in the IT equip­ment and poten­tially alle­vi­at­ing hot spots in the data centre.

Coordin­ate CRAC units: Older CRAC (com­puter room air-conditioning) units operate inde­pend­ently with respect to cooling and dehu­mid­i­fy­ing the air. These units should be tied together with newer tech­no­lo­gies so that their efforts are coordin­ated, or man­agers should remove humid­i­fic­a­tion respons­ib­il­it­ies from them alto­gether and place those respons­ib­il­it­ies on a newer piece of technology.

Improve under floor airflow: Older data centres typ­ic­ally have con­strained space under­neath the raised floor that is not only used for the dis­tri­bu­tion of cold air, but also has served as a place for data cables and power cables. Many old data centres have accu­mu­lated such a tangle of these cables that airflow is restric­ted, so the under floor should be cleaned out to improve airflow.

Imple­ment hot aisles and cold aisles: In tra­di­tional data centres, racks were set up in what is some­times referred to as “classroom style,” where all the intakes face in a single dir­ec­tion. This arrange­ment causes the hot air exhausted from one row to mix with the cold air being drawn into the adja­cent row, thereby increas­ing the cold-air-supply tem­per­at­ure in uneven and some­times unpre­dict­able ways. Newer rack layout prac­tices insti­tuted in the past 10 years demon­strate that organ­iz­ing rows into hot aisles and cold aisles is better for con­trolling the flow of air in the data centre.

Install sensors: A small number of indi­vidual sensors can be placed in areas where tem­per­at­ure prob­lems are sus­pec­ted. Simple sensors store tem­per­at­ure data that can be manu­ally col­lec­ted and trans­ferred into a spread­sheet, where it can be further ana­lyzed. Even this minimal invest­ment in instru­ment­a­tion can provide great insight into the dynam­ics of pos­sible data centres tem­per­at­ure prob­lems and can provide a method for ana­lyz­ing the results of improve­ments made to data centre cooling.

Imple­ment cold-aisle or hot-aisle con­tain­ment: Once a data centre has been organ­ized around hot aisles and cold aisles, dra­mat­ic­ally improved sep­ar­a­tion of cold supply air and hot exhaust air through con­tain­ment becomes an option. For most users, hot-aisle con­tain­ment or cold-aisle con­tain­ment will have the single largest payback of any of these energy effi­ciency best practices.

Raise the tem­per­at­ure in the data centres: Many data centres are run colder than an effi­cient stand­ard. ASHRAE (the Amer­ican Society of Heating, Refri­ger­at­ing, and Air-Conditioning Engin­eers) has increased the top end of allow­able supply-side air tem­per­at­ures from 77 to 80 degrees Fahren­heit. Not all data centres should be run at the top end of this tem­per­at­ure range, but a step-by-step increase, even to the 75 to 76 F range, would have a bene­fi­cial effect on data centre elec­trical use.

Install variable-speed fans and pumps: Tra­di­tional CRAC and CRAH (com­puter room air handler) units contain fans that run at a single speed. Emer­ging best prac­tices suggest that variable-speed fans be used whenever pos­sible. A reduc­tion of 10 percent in fan speed yields an approx­im­ately 27 percent reduc­tion in the fan’s elec­trical use, and a 20 percent reduc­tion in speed yields elec­trical savings of approx­im­ately 49 percent.

Exploit “free cooling”: Free cooling is the general term for any tech­nique that cools air without the use of chillers or refri­ger­a­tion units. The two most common forms of free cooling are air-side eco­nom­iz­a­tion and water-side eco­nom­iz­a­tion. The amount of free cooling avail­able depends on the local climate, and ranges from approx­im­ately 100 hours per year to more than 8,000 hours per year.

Design new data centres using modular cooling: Tra­di­tional raised-floor-perimeter air dis­tri­bu­tion systems have long been the method used to cool data centres. However, mount­ing evid­ence strongly points to the use of modular cooling (in-row or in-rack) as a more energy-efficient data centre cooling strategy

The entire report ($195) can be found on the Gartner Web site: “How to Save a Million Kilo­watt Hours in Your Data Center.”

Usually seen when sizing unin­ter­rupt­able power sup­plies the Volt-Amp is often con­fused with Watts, they are not the same. The power require­ment of a piece of equip­ment is expressed in Watts of Volt Amps (VA), the most common example being of course the 100W light bulb.

A Watt is the actual or true power used or dis­sip­ated by the device

A Volt Amp is called the appar­ent power and is obtained by mul­tiply­ing the voltage by the current drawn by an altern­at­ing current device.

This is a small but sig­ni­fic­ant dif­fer­ence. The Watt rating is used for meas­ur­ing the power used and res­ult­ant heat. The VA is used for sizing calculations.

There are two types of load, res­ist­ive and reactive.

A light bulb is res­ist­ive but a com­puter or other elec­tronic device is reactive.

If we cal­cu­lated a the power used for a res­ist­ive light bulb oper­at­ing at 240volts and drawing 0.25ampere it is a matter of apply­ing a simple formula;

Power = Voltage x Current or 240 x 0.25

60 watts, the VA rating would be exactly the same.

Where the load is react­ive a power factor must be used. With react­ive loads a certain amount of power is absorbed by and sub­sequently released by the device. This power amount is called the react­ive power or the dif­fer­ence between appar­ent and true power.

In an example where a com­put­ing device has an imped­ance of 120 Ohms using Ohms law (current = voltage/resistance) 240/120 will produce a current figure of 2 amps.

Using the same formula as above to get power

Power = Voltage x Current or 240 x 2

The appar­ent power would then be 480VA

Since the load is elec­tronic, a power factor must be applied. Dif­fer­ent devices will have dif­fer­ent power factors; in this case the com­puter has a power factor of 0.9

Apply­ing the power factor to the appar­ent power results in a watt figure of 480 x 0.9 = 432 watts

This dif­fer­ence between the appar­ent power and true power is react­ive power, in this example 48 Volt Amps.

The vast major­ity of modern large com­puter devices now have very high power factors, usually close to 1 but smaller devices such as PC’s may be as low as 0.65

However, UPS devices do not have this high power factor. UPS devices are rated in VA with a stated power factor. The power factor is gen­er­ally accep­ted to be 0.6 for UPS devices designed to power PC’s and other small devices.

A typical 500VA UPS would deliver 300 Watts. To com­plic­ate things even further large UPS’s now have very high power factors, approach­ing 1

The UPS will have both maximum VA and Watt ratings that cannot be exceeded.

Careful thought needs to be applied to the correct sizing of UPS’s taking into account the nature of the load and design spe­cific­a­tions of the UPS itself in order to avoid errors. The safest approach is to keep the load at less than 60% of the VA rating of the UPS or seek expert advice