Wake-up call: Are your IT systems ready for a data disaster?

While the exact cause is not certain (and it is not clear whether the incidents are linked), the organisations involved have all indicated that the outages were caused by failed software updates. There is no suggestion that the issues were the result of a cyberattack, or that any personal data was compromised in any of the outages.

Cybersecurity efforts often focus primarily on protecting data, particularly personal and confidential data, but in reality this is just one part of an effective cybersecurity and cyber resilience strategy. The ‘CIA triad' confidentiality, integrity and availability) will be a familiar concept to security experts, and system availability is just as important a part of that triad as the confidentiality and integrity of systems and data.

The recent issues suffered by these brands have shone a light on the need to ensure that IT systems are both robust and resilient, to enable businesses to keep operating as normal when key systems are affected by technical issues.

In the wake of these incidents, hospitality businesses should take steps to make sure their technical systems are as resilient as possible, including:

• Maintaining a comprehensive inventory of IT systems across the organisation, including their criticality to the day-to-day running of the business and how systems interact with each other. This can help ensure that efforts are focused on the most important systems in the event of any issues arising, as well as informing where the most spend is necessary.
• Creating a comprehensive, bespoke and up-to-date business continuity and disaster recovery plan, which considers all potential availability issues that could affect business-critical systems, how these could impact the business and its customers, and how issues should be addressed as they arise to ensure continuation of business operations with as little disruption as possible.
• Regularly testing and practising the implementation of that plan, so that potential weaknesses can be identified and remedied, and to ensure that staff members involved are familiar with the relevant processes and they can be implemented as swiftly as possible.
• Ensuring that systems are built and implemented with resilience in mind, including having back-up systems for failover purposes, so that if one system fails, another system kicks in to ensure continued operation.
• Reviewing arrangements with IT system vendors to make sure there are robust service levels requiring swift action in the event of availability issues, as well as clear and effective workarounds for business-critical systems.
• Implementing automated, continuous monitoring of systems to identify potential issues as early as possible, and ensuring that staff are trained to recognise early signs of cybersecurity risks.

• As we become more and more dependent on technology as a society, the potential for cybersecurity issues will only increase. It is vital that businesses prioritise cybersecurity and cyber resilience, as headlines like those we saw in March demonstrate the enormous impact that security issues can have.

Steps such as those set out above can help hospitality organisations ensure they are prepared when problems do occur, and that they can manage them swiftly and effectively while operating as close to normally as possible.

Emma Erskine-Fox is a managing associate in the tech, IP and data team at law firm TLT

Pictured: Data outages suffered by McDonald's in March led to the fast-food operator turning customers away as it couldn't take orders at the tills

Photo: Powerofflowers/Shutterstock