Legal Factors in IT Disaster
Let's first start with the legal factors involved in business continuity services for small business and larger organization alike. The legal factors in corporate contingency planning can often be very confusing. In effect, all companies require a certain 'standard of care'-legally.
The planners in most small and medium sized businesses are not expected to be lawyers but they are expected to understand the current regulatory environment and legal consequences of not having a comprehensive disaster recovery plan. Although there are no laws that specifically address the need for companies to have a disaster recovery plan or what should be included in one, there are many civil statutes that are applicable.
Some industries do have their own statutes, such as the financial industry's Banking Circular BC177; however, normally courts will look for precedents set by other cases. An example of this is the Foreign Corrupt Practices Act or FCPA. This act requires corporations to keep accurate books and records that reflect the transactions and dispositions of assets. This act was originally designed to eliminate bribery and destruction of corporate documents to cover up a crime.
Even if your organization isn't exposed to an Enron-like investigation there is still room for fault. Since all these statutes are based on the moral/legal obligation called 'standard of care' a certain level of corporate obligation is always present and necessary.
Excerpt from the FCPA "directors and officers owe a duty to the corporation to be vigilant and to exercise ordinary and reasonable care and diligence and the utmost good faith and fidelity to conserve the corporate property; and, if a loss or depletion of assets results from their willful or negligent failure to perform their duties, or to a willful or fraudulent abuse of their trust, they are liable, provided such losses were the natural and necessary consequences of omission on their part...." (Reference: Corpus Juris Secundum, Volume 19, Section 491)
The FCPA holds corporations as well as the officers/managers of a corporation personally responsible with personal fines adding up to $10,000 and corporation fines adding up to $1,000,000. These fines can also include prison terms of up to 5 years.
Even Errors and Omissions (E&O) policies will not alleviate managers and officers of legal responsibility and, thus going to court, as they cover only consequential damages and do not relieve corporate responsibility and accountability. Courts determine liability by weighing the probability of a loss compared with the magnitude of harm balanced against the cost of protection. There are enough legal precedents for the courts to estimate if 'standard of care' and/or due diligence was exercised in an attempt to mitigate any effects of a disaster effecting a company's critical business operations. All in all, a disaster recovery plan makes sense for any business. It's not an end all solution to legal entanglements but it's definitely something that should be included in a company's arsenal.
Read on about Disaster Recovery Planning:
IT Disaster Legal Factors
IT Disaster Prevention
IT Disaster Mitigation
All of the insurance coverage mentioned in this article can be secured through Mr. Bob Marrone (Phone: 510-832-8000 x135), an excellent insurance agent that we have worked with for over 6 years and helped us write this article. ActivSupport provides Disaster Recovery Planning services to organizations across the U.S, and can be contacted at 877-ACTIVNET or sales@activsupport.com.
