Repost Only

Policy Structure

• Server maintenance policies should include the policy's purpose, authority, roles and responsibilities of users, applicability, scope and communication requirements, at a minimum. The State of Montana Server Maintenance Policy goes beyond these categories to include policy change control and exceptions to policy; references; definitions; and policy contact information.

Purpose and Authority

• These sections define the policy's purpose or reason for existing, and the governing body that has authorized the policy. In some cases, the policy will have been developed as required by law, or an organization's board of directors may have commissioned and approved it.

Responsibilities of Users

• A responsibilities section is useful to ensure that only a designated group of employees or contractors is responsible for undertaking server maintenance activities. In some organizations, department heads may believe that it is in their best interest to control server activities; however, server maintenance is a critical role and should only be performed by knowledgeable, authorized individuals. Usually, someone in the information technology department performs maintenance.

Applicability and Scope

• These sections define the functions of the business, both in-house and outsourced, that the policy applies to. They will also define whether the policy applies only to in-house staff or also to staff working for outsourced agencies. The scope section addresses conflicting policies, usually indicating that in the case of a conflict, the more restrictive policy will govern.

Communication Requirements

• Because server maintenance activities require that users log off of information systems, the policy will define how far in advance users will be notified of upcoming scheduled maintenance. The policy will usually require that maintenance be performed during off-peak hours, if possible.
  A server maintenance policy will usually provide details about what to include in communications to employees, including informing users about the scheduled maintenance; asking them to logoff of the system at a specified time; and notifying them as to how long the system will be unavailable.

Policy Change Control and Exceptions

• The policy document itself might define how changes to the policy are to be submitted for consideration, or direct the reader to an organization-wide change control policy. It might also include instructions for how to handle policy exceptions, such as when a server is shut down due to an emergency.

References, Definitions and Policy Contact Information

• A server maintenance policy might include references to governing laws or overarching organizational policies; provide definitions of key terms or maintenance intervals; and provide information on how to contact the policy author.