Comprehensive, systematic , and unbiased risk assessment is essential to the long-term security and reliability of SP and its archived information. Risk assessment helps the repository identify and evaluate threats that could disrupt normal operations or impair its ability to meet its Mandatory Responsibilities and contracted obligations. SP began formally documenting and analyzing risks in the fall of 2011. The participants included key personnel from SP, OCUL, and the University of Toronto Libraries, and the Libraries' Information Technology Services. In many cases, the risk analysis documented threats that librarians, architectssystems administrators, and programmers had already addressed in the design and implementation of the repository.
At present, SP does not employ a third-party code of practice for risk analysis. Instead, SP reviewed risk assessment practices used by a variety of revelant institutions and organizations in order to minimize the impact of biases in individual codes avoid being 'locked in' to a particular code of practice. Following the review, SP designed a risk analysis model that suited the repository's operating conditions and technical environment.
Please see the Risk Analysis and Management Strategies document for details. This document satisfies the criteria by identifying identifies threats, assessing assesses their probability and potential impact, and providing provides an overview of the repository's risk-minimization and prevention strategies.
The chief risks associated with risk analysis are (1) failure to review and update the analysis in a timely and consistent manner and (2) failure to acknowledge and analyze foreseeable risks. To minimize the first risk, SP has monitoring commitments in place (see next itemMonitoring Commitments below). To minimize the second risk, SP uses a comprehensive typology of threats as a model for identifying foreseeable and relevant risks (described in the Risk Analysis and Management Strategies document).
The repository will assess its risk analysis on a regular basis, according to the Review Cycle for Documenation Documentation Policy, or whenever there are major changes to its operating environment such as hardware refreshment, significant staffing level changes, or cyber attacksecurity incidents.
SP recognizes that formal security audits and third-party vulnerability assessments could be valuable. In the long run, the repository would like to establish an online mirror site to provide full, continuous redundancy of archival storage, data management, and dissemination systems.