Electronic Data Backup Procedure

[Connie82]

Procedures

I have been given a task by my boss to see what other companies do as a backup procedure. My question is this, does anyone know what the specifications are of QS9000 regarding backups? Such as how long we have to keep tapes, how many sets of tapes we keep, etc. If anyone could help me with this, it would be appriciated! Thank you!

connie

 

[Russ]

Backup

I see no requirement in QS for backup of data, it just makes common sense to do so though. Our procedure reads:
"Any critical data maintained on PCs is backed-up no less than one time per week. Corporate data files maintained on the mainframe are backed-up daily, and the entire system is backed-up one time per week. Back-up copies are maintained offsite."
Maybe this will help!

 

[Claes Gefvenberg]

Welcome to the Cove

We use this variant...

The entire mainframe is backed up on a tape device:

Daily: We use 7 tapes for this, so this backup lasts for one week

Weekly: Every sundays backup is transferred to a fireproof safe in another building. Kept for 5 weeks. (One of our sites was destroyed in a fire earlier this year. The backups were stored in a different location, and survived - An already grave situation would have been a lot worse if the data had been destroyed)

Long term: I can't remember the frequency, but we have older tapes going back many years.

It's vital to keep replaced backup equipment in working order. Old backups must be accessable.

And hey... Welcome to the Cove..

/Claes

 

[JodiB]

Same here

We do much the same. Daily backups plus then a weekly backup and then a quarterly backup. Tapes are taken home each night by an employee. (hmmm. what if they wanted to sabotage us?)

Our approved forms, templates, and procedures are set up to synchronize on everyone's computer at shutdown, so even if network is down these bits are still available.

We don't have a written procedure for this but I have asked our IT consultant to write a disaster recovery plan for us since we have identified Information Systems as a process.

 

[CarolX]

Re: Procedures

Hi Connie and welcome to the Cove,

Connie82 said:

I have been given a task by my boss to see what other companies do as a backup procedure. My question is this, does anyone know what the specifications are of QS9000 regarding backups? Such as how long we have to keep tapes, how many sets of tapes we keep, etc. If anyone could help me with this, it would be appriciated! Thank you!

connie

We are not QS9K, but we are ISO9K:1994. This issue came up during our initial assesment, and I received a minor N/C because we did not address back-up of computer records. I plugged this section into my Engineering Document Control Procedure:

5.0 BACKUP OF COMPUTERIZED RECORDS

5.1. TAPE BACKUP OF JOB MAINTENANCE SYSTEM IS PERFORMED BY ENGINEERING DAILY.

5.1.1. TAPES CREATED ON MONDAY, TUESDAY, WEDNESDAY AND FRIDAY ARE STORED ON SITE AND REUSED WEEKLY.

5.1.2. TAPES CREATED EVERY THURSDAY ARE STORED OFFSITE AND REUSED AFTER 5 WEEKS.

5.2. TAPE BACKUP OF ACCOUNTING FILES AND PROGRAMMING FILES IS PERFORMED BY DEPARTMENT LEADS WEEKLY. TAPES ARE STORED OFFSITE BY ENGINEERING AND REUSED AFTER 1 WEEK.

Our auditor position was that some of thiese files contain records, and how did we prevent damage to the records. We were doing the action, and he wanted the issue addressed in our procedure. As I said, it was a minor N/C, I tossed in these few lines, and we were good to go.

Regards,
CarolX

 

[CarolX]

Re: Same here

Lucinda said:

We do much the same. Daily backups plus then a weekly backup and then a quarterly backup. Tapes are taken home each night by an employee. (hmmm. what if they wanted to sabotage us?)

Lucinda,

That is pretty standard practice, removing the tapes from the premesis. Our weekly backup is removed from the premesis and stored in a fireproof lockbox in the man's home.

I wouldn't be too concerned about the sabatoge thing, your doing daily and weekly. If the guy pops a cork and it takes you a week to discover this, you have only lost a weeks worth of data.

I know there are systems that require a much more secure method (i.e. banks), but for us regulars, that should work.

Regards,
CarolX

 

[energy]

Two extremes

One place-we had a fireproof safe deposit box in a local bank.
One place-we had them in the IT Guys's glove compartment in his car. Neither one was an issue with the customer auditors. But, ISO, who knows?

 

[Laura - 2003]

Amazing coincidence

We've just been thru a periodic assessment (1994) and non-conformed on back-up of data.

Our main servers are controlled and backed up by a dept...not within our scope, but the assessor went to see them, took a look at the SLA and returned satisfied..however he was not happy about remote back-ups.

Our consultants have laptops and store much of their information on their hard drives. One of the auditees confessed that he did not conduct back-ups of his hard drive data onto the network, as often as he should. He hadn't done them at all in the last six months.

He non-conformed us....as I knew he would.....and said that we needed to document a QP (fair enough) and provide evidence of audit prior to the next assessment....fair enough.

I have found a way to ensure that when a consultant plugs his laptop into a hot desk....his files will automatically back-up onto the server...I've documented this in a procedure.

Does anyone think I will need more?

Lau~.

 

[E Wall]

What We Do...

Much the same as the others:
Backups performed Daily, Weekly, and Monthly. The monthly tape is sent off-site.

 

[Graeme]

nothing is forever ...

There are a lot of good and sound ideas in this thread about backup stategies. I just want to add a couple of things about off-site and long-term storage.

(1). Several people have mentioned keeping offsite backup copies in a fireproof safe. This is a great idea, PROVIDED you are using one designed and certified for data media. The great majority of fireproof safes are designed to keep the internal temperature below the ignition point of PAPER for a specified period of time. If you remember the title of a famous book by Ray Bradbury you know that the ignition point of paper is 452 degrees F. These safes do that by releasing large amounts of water from the material that forms the insulation. (hydrated something - I don't remember exactly.) The steam keeps everything (relatively) cool. There are two tiny little problems ...

• Plastic melts at much lower temperatures, and almost all media are plastic or contain large amounts of it. (Have you ever left a CD in the back window of a car in the summer?)
• The principal component of magnetic media is iron. Iron rusts (oxidizes). Other materials in the magnetic coating also oxidize or corrode, and do it faster in a high-temperature steam environment.

Again, the fireproof safe must be rated for use with data media, or you may wind up with a pile of melted, rusty plastic.

(2). Many organizations keep backups or other archives in long term storage for various reasons. (years or decades) If you do, you should have a policy for regularly testing and refreshing the data.

• At regular intervals, test it to see if the data is still readable.
• Verify that you still have the machines available to read it. (I still have one 8-inch floppy disk. Does anyone have a drive for that?)
• Plan to copy the data to the newest available permanent storage media. (Currently CD-R or mabe DVD-R)
• Plan to convert the information to new data formats before the old becomes unreadable.
• Remember that all data recording media has a limited useful lifetime. There have been numerous well-documented cases of losses of old motion pictures and audio recordings because of deterioration of the film or tape. CD-R may prove to have a long life but we don't know yet.
• Make sure that the storage environment is suitable for preserving the life of the storage media.

Above all, protect your :ca: and make your backups BEFORE you need them.