Summary
On July 11, 2012, a fire in the Shaw Court building in Calgary rendered the data centre located in the building unusable. As a result, many organizations that relied on IT services from this data centre were unable to carry on their normal operations. Among those affected were oil companies, radio stations, and Government of Alberta entities. Although all the government entities using that data centre had disaster recovery plans, they were still unable to provide all the programs and services they expected to within expected times.
Alberta Health Services was unable to access the electronic patient health records in order to provide the necessary healthcare services—i.e., electronically order lab or other diagnostic tests, electronically chart results or notations, and electronically order medications. ATB Financial was unable to provide customer care through its call centre. ATB’s online banking, electronic fund transfers and ability to accept some loan applications were also unavailable for up to three days after the incident. Government services such as driver’s licenses, land titles, and birth, death and marriage documents were also unavailable.
During and after the Shaw Court fire no coordinated group within government was able to clearly state to Albertans:
- what went wrong
- what was being done to return IT applications to service
- that the government had a clear plan to recover the most critical applications, based on risk and cost, and that it might mean some IT applications may not be available
What we found
It is now two years since the fire at the Shaw Court building. The individual government entities we assessed have better disaster recovery capabilities as a result of identifying and fixing weaknesses in previous disaster recovery plans. However, if a similar incident occurred today, the government would still be unable to say it knows what the most critical government-wide IT applications are, or that it has well-designed and tested plans and the needed resources to recover them within targeted times.
The Government of Alberta needs to:
- identify its critical programs and services government-wide, and the IT applications that support them
- make government-wide decisions of needed recovery times for critical IT applications and the order they should be recovered based on need, risk and cost
- ensure that the critical IT applications have well-designed and tested recovery plans, and the resources needed to recovered them within those targeted recovery times