University of Massachusetts Medical School's Data Center Relocation

This is a state IT audit of UMass Medical School’s data center relocation, covering planning, contracts, security, environmental safeguards, and recovery planning.

“In accordance with Chapter 11, Section 12, of the General Laws, we performed an IT audit regarding the relocation of UMMS’s data center for the period July 1, 2008 through August 31, 2010.”

The auditor reviewed whether the school had enough controls to manage the move safely and protect the systems in the new data center.

“Our primary audit objective was to determine whether UMMS’s IT-related internal control environment, including policies, procedures, practices, and organizational structure, provided reasonable assurance that control objectives would be met to support UMMS’s project planning and relocation to the new data center.”

If the data center went down, weak recovery planning could slow the return of important computer systems used by the school.

“Nevertheless, UMMS could experience delays in recovering IT operations because its disaster recovery and business continuity plans need to be more comprehensive and detailed.”

For ordinary residents, this matters because UMMS is a public institution, and its technology supports education, research, health care work, and administrative services.

“UMMS’s primary mission is to advance the health and well-being of people through pioneering advances in education, research, and health care delivery.”

The move appears to have been handled well overall, but the school needed better written, tested plans for major outages and better long-term IT planning.

“Based on our examination, we have concluded that, except as noted in the Audit Results section of this report, for the period July 1, 2008 through August 31, 2010, adequate internal controls were in place to provide reasonable assurance that IT control objectives would be met regarding IT organization and management, on-site and off-site storage of back-up copies of magnetic tape media, and IT-related service contracts associated with the data center relocation.”

The auditor recommended that UMMS improve recovery planning, test plans, clarify responsibilities, train staff, and build a formal IT strategic planning process.

“We recommend that IS adopt an IT strategic planning process in which IT strategic plans are developed in alignment with UMMS’s organizational business strategy.”

The biggest risk was not that the new data center lacked security or capacity; it was that UMMS did not yet have fully formal, detailed plans for recovery and IT governance.

“Without a comprehensive and well-documented formal business continuity and disaster recovery strategy for all IS functions and operations, UMMS may be unable to recover mission-critical and essential business activities in an acceptable and timely manner.”

“Disaster recovery and business continuity” means having detailed plans so essential computer systems and business work can restart after a major outage or emergency.

“IT business continuity planning consists of a coordinated strategy involving plans, procedures, and technical measures that enable the recovery of mission-critical and essential IT systems and operations and access to online information.”