Preservation of Electronic Data / Information Technology

[duff999]

Hi Folks

I have the task of writing an SOP regarding Preservation of Electronic Data / Information Technology for a small company that uses an electronic QMS. I was gearing this towards the following:

1. How the eQMS is backed up and retention
2. How our Google Drive is managed, backed up.
3. How we backup our local data, and offsite storage.

We are not server based, just as an fyi

I am ot even sure if this is the right approach and was looking for any tips anyone has regarding this SOP.

Thanks

 

[Ninja]

Been there, though I had off-site consultants doing the nitty gritty.

I would:
1. write minimum requirements...using the phrase "or equivalent" frequently.
"Backups should be RAID 1 or equivalent (or better)"
"At least two off site backups (or equivalent) must be kept"... that kind of stuff...so you don't have to rewrite the whole thing when tech improves.

2. Write the step by step process as "Example 1"...so if little tweaks happen later you don't immediately become non-compliant.
Google drive changes the manager screen layout, dropdown titles, etc.

FWIW, most folks would consider Google drive to be "a server"...but call it whatever you want.
eQMS not on a server? So you can only access it through a single hard drive and single screen?

When it comes to writing, write the top level stuff vague...what is needed? Google drive is not needed, a cloud or server based data storage is needed.
When you get to the nitty gritty, that's when you mention Google Drive (or equivalent). eQMS database (or equivalent), etc.

Then in Example 1...it's a step by step instruction (with screenshots) so that any competent person can perform the task if you get hit by a bus.

Taking this approach, you have an overview which is a little flexible if OneDrive gives you a great deal next month, or RAID5 becomes cheaper than RAID1 or, or, or ...but you also capture the current state with detailed instructions like a manual.

HTH.

 

[duff999]

Been there, though I had off-site consultants doing the nitty gritty.

I would:
1. write minimum requirements...using the phrase "or equivalent" frequently.
"Backups should be RAID 1 or equivalent (or better)"
"At least two off site backups (or equivalent) must be kept"... that kind of stuff...so you don't have to rewrite the whole thing when tech improves.

2. Write the step by step process as "Example 1"...so if little tweaks happen later you don't immediately become non-compliant.
Google drive changes the manager screen layout, dropdown titles, etc.

FWIW, most folks would consider Google drive to be "a server"...but call it whatever you want.
eQMS not on a server? So you can only access it through a single hard drive and single screen?

When it comes to writing, write the top level stuff vague...what is needed? Google drive is not needed, a cloud or server based data storage is needed.
When you get to the nitty gritty, that's when you mention Google Drive (or equivalent). eQMS database (or equivalent), etc.

Then in Example 1...it's a step by step instruction (with screenshots) so that any competent person can perform the task if you get hit by a bus.

Taking this approach, you have an overview which is a little flexible if OneDrive gives you a great deal next month, or RAID5 becomes cheaper than RAID1 or, or, or ...but you also capture the current state with detailed instructions like a manual.

HTH.

Been there, though I had off-site consultants doing the nitty gritty.

I would:
1. write minimum requirements...using the phrase "or equivalent" frequently.
"Backups should be RAID 1 or equivalent (or better)"
"At least two off site backups (or equivalent) must be kept"... that kind of stuff...so you don't have to rewrite the whole thing when tech improves.

2. Write the step by step process as "Example 1"...so if little tweaks happen later you don't immediately become non-compliant.
Google drive changes the manager screen layout, dropdown titles, etc.

FWIW, most folks would consider Google drive to be "a server"...but call it whatever you want.
eQMS not on a server? So you can only access it through a single hard drive and single screen?

When it comes to writing, write the top level stuff vague...what is needed? Google drive is not needed, a cloud or server based data storage is needed.
When you get to the nitty gritty, that's when you mention Google Drive (or equivalent). eQMS database (or equivalent), etc.

Then in Example 1...it's a step by step instruction (with screenshots) so that any competent person can perform the task if you get hit by a bus.

Taking this approach, you have an overview which is a little flexible if OneDrive gives you a great deal next month, or RAID5 becomes cheaper than RAID1 or, or, or ...but you also capture the current state with detailed instructions like a manual.

HTH.

Good information.

Currently all of QMS is cloud based, so I can describe the process or storage and retrieval, Google Drive also holds some of our records that we dont keep in our eQMS (spreadsheets, inspection records, etc), I can explain how data is stored, backed up, and retrieved if necessary. We do not backup local laptops, anything that would affect product quality, or QMS should not be stored locally.....is this enough to explain, or should we put a policy in place that local laptops connected to the network should be backed up.

 

[Ninja]

Not sure if that was a question or not...so let me comment this way:

If your company thinks it's important, it should be done.
There is a goal set (Preservation of Electronic Data / Information Technology )
There is an assumed goal also set (folks have to be able to get at it).

The high level is "Why are we doing it? What are the general requirements to achieve that goal?"
The mechanics of how your particular company chooses to do it...that's the "Example", for QMS, for Any other way of storing or preserving data.

QMS is cloud based (that's a server BTW) and is already not local.
Google Drive is cloud based (also a server) and already not local.
Does your company care if laptops are backed up? You need an answer to this before you start writing.
If a laptop was lost or fried...would you care about the potential data loss?
Does your company need/want your own copies of what is on Google Drive or your cloud QMS? or do you trust those folks to backup and preserve?

Flesh out (for yourself, not here) the whole picture of data preservation...
What data?
How is it initially stored/recorded the first time at data generation?
How is it protected prior to compilation?
How is it complied for longevity storage?
How is it then protected?
How long is it to be kept?
How/who/when can you then retrieve it?

Walk mentally through the process of how the data is handled already, from generation to backup retrieval to disposal... correct or question the process as needed... then let that guide your SOP document.
In my experience, laying the whole thing out in a flow chart will make life easier...and I would show said flowchart to top management (they likely don't think about this stuff often) and see if the system you found is at all the system they want ... or if it really makes any sense at all.
Then document the process.

 

[duff999]

Great information Ninja, thanks for allowing me to see the whole picture. I appreciate you taking the time explaining this, very helpful.

 

[Ninja]

Happy to help... been through that task often enough...
My mantra through the whole thing (every time).

Time is expensive. People are expensive. Losing data is expensive.
Storage is cheap.