S 3.3 Arrangements for substitution

Initiation responsibility: Information Security Management, Head of Organisation

Implementation responsibility: Supervisor

Substitution arrangements are used to ensure an organisation can continue to operate and perform its tasks in the case of planned absences of personnel (due to holidays or business trips), but also in cases where this was not planned (due to illness, accidents, or termination of employment). For this reason, it must be clarified in advance of such cases who will substitute for whom in which business matters and with which authorities. This is especially important in the area of information processing, because specialised knowledge is usually required and it is normally impossible to quickly train an untrained employee to act as a substitute in such cases.

The following general conditions must be met by substitution arrangements:

• Sustainable substitution arrangements must be established for all essential business processes and tasks. These must be updated regularly.
• The ability of a substitute to take over the original employee's tasks when necessary assumes that the status of the process or project has been adequately documented.
• In general, it is not enough just to appoint a substitute alone; it is also necessary to check what kind of training the substitute needs to be qualified to take over the corresponding tasks. If it is discovered that there are some people who cannot be quickly replaced due to their special knowledge, their absence poses a serious threat to normal operations. In such cases, it is particularly important to train a substitute.
• It must be specified which tasks will be taken over by whom and to what extent they will be taken over in case a substitute is needed.
• The substitute should only be granted the site and/or system access authorisations required for substitution when actually required to substitute.
• If it is impossible in exceptional cases to appoint or train a competent substitute for some people, it is necessary to determine which external personnel could be called in to act as substitutes well in advance.

Review questions:

• Are there substitution arrangements available for all areas?
• Has it been ensured that adequately qualified substitutes will be available when required?