In this followup, we found Service Alberta has made a number of process improvements since 2014, including:
- developing a framework that provides IT disaster-recovery requirements, tools, and guidance to departments
- developing a central repository to track disaster-recovery-related information for all IT applications across government
- developing recovery time requirements for IT applications based on criticality categories
- implementing an annual exercise to help departments test the recovery of critical IT applications
We also found that Service Alberta has more work to do. While the criticality assessments of 1,300 IT applications have been completed, more than 200 applications have yet to be assessed. Service Alberta does not ensure that all IT applications assessed as critical by departments comply with its IT disaster recovery policies, and it does not follow up with departments when IT disaster recovery requirements are not met.
Until these process weaknesses are fixed, Service Alberta cannot assure Albertans that all critical services they rely on can be promptly recovered if they go offline.
As a result, we repeat our 2014 recommendation.