5.2.1 - The repository shall maintain a systematic analysis of security risk factors associated with data, systems, personnel, and physical plant.
Comprehensive, systematic, and unbiased risk assessment is essential to the long-term security and reliability of Scholars Portal and its archived content. Risk assessment helps the repository identify and evaluate threats that could disrupt normal operations or impair its ability to meet its mandatory responsibilities and contracted obligations. Scholars Portal began formally documenting and analyzing risks in the fall of 2011. The participants included key personnel from Scholars Portal, University of Toronto Libraries, and the Library's Information Technology Services. In many cases, the risk analysis documented threats that librarians, architects, and programmers had addressed tacitly in the design and implementation of the repository.
At present, Scholars Portal does not employ a third-party code of practice for risk analysis. Instead, Scholars Portal reviewed risk assessment practices used by a variety of institutions and recommended by various organizations in order to minimize the impact of biases or idiosyncracies in individual codes of practice. Following the review, Scholars Portal designed a risk analysis model that suited the repository's operating conditions and technical evironment.
The complete text of the Risk Analysis and Management Strategies document is available through the link below. The document satisfies the criteria by identifying threats, assessing their probability and potential impact, and providing an overview of the repository's mitigation and prevention strategies.
Digital Preservation Policy Librarian - Ensures proper functioning of overall system.
The chief risks associated with risk analysis are (1) failure to review and update the analysis in a timely and consistent manner and (2) failure to acknowledge and analyze foreseeable risks. To mitigate the first risk, Scholars Portal has monitoring commitments in place (see next item). To mitigate the second risk, Scholars Portal uses a comprehensive typology of threats as a model for identifying foreseeable and relevant risks (described in the Risk Analysis and Management Strategies document below).
The repository will assess its risk analysis on a regular basis, according to the Review Cycle for Documenation Policy, or whenever there are major changes to its operating environment such as hardware refreshment, staffing changes, or cyber attack.
Scholars Portal recognizes that formal security audits and third-party vulnerability assessments could be valuable. In the long run, the repository would like to establish an alternate hot or 'mirror' site to provide full, continuous redundancy of archival storage, data management, and dissemination systems.