So You have a 30 day Data Retention Policy -- Think Again - September 10, 2009
Miami Florida ---- In the U.S. legal system, there are two fundamental obligations of all parties to a lawsuit. The first is to tell the other side about all information that might be relevant to the lawsuit. The second is to hand it all over.
In the good old days when information was just on paper, it was simpler to tell what you had. Someone created a list of all the filing cabinets and boxes of paper in storage, noted what was inside each and sent the list to the opposing party. Then the paper documents were gathered by staffers who put them in boxes and sent them to the company's legal counsel, who conducted a "privilege review" by flipping through page after page of the documents to determine whether any could be excepted.
The good old days are gone. In place of all those file cabinets, we now have electronic backup media, and IT holds the key to it all.
How important is it? Here's what can happen if your company is unable to tell what it has in a timely manner. In a lawsuit between businessman Ron Perelman and Morgan Stanley over a complicated deal, Perelman won. Or rather, Morgan Stanley lost. It lost because it didn't tell its opponents about backup tapes in its possession until after certain deadlines had passed. Morgan Stanley was late with this disclosure because more tapes turned up in a storage closet after deadline. It didn't lose on the facts of the lawsuit; it lost because the judge ruled that the company was flouting one of the fundamental obligations of our legal system: Tell what you have. This mistake cost Morgan Stanley $1.45 billion. (The verdict is being appealed.)
You can begin to avoid this kind of disaster by mentally assigning to each backup tape a value that reflects something of its true worth to your company should it become involved in a lawsuit. Imagine that each backup tape is worth, say, $1 million. Then think about how you would manage an information resource of that value.
Here are some suggestions:
Document your backup tape procedure. If you don't have a policy, write one. Imagine documenting the tape backup process so that your successor could keep things running the day after you've been hit by a bus. This is absolutely vital to defending whatever you do with tapes. The policy should:
1. Describe how your tape backup process works.
What data is written to which device, and what type of tape is used?
What is your tape-rotation cycle? (Which tapes get overwritten when?)
Where are tapes stored?
Who are the staffers responsible?
2. Describe how you account for tapes. The simplest method: Purchases minus destroyed tapes equals tape count.
3. Describe how and when you destroy tapes, and include a sample destruction certificate.
Review your corporate history. Consider that a lawsuit might go back five years. Then check to see if your company has merged or otherwise joined forces with any other company during that period. If so, be sure you have a complete inventory of the backup tapes in possession of the acquired company. Physically inspect the acquired company's site to check every possible location that backup tapes might be kept. Don't forget former managers who may have taken tapes off-site, storage providers that routinely handle backup tape storage, the old data center and the old IT manager's office. Remember, these tapes are worth a million dollars each. You want to find every one.
Remember, too, that the tapes created by an acquired company are now yours. You need to know as much about those tapes as any others in your custody.
Keep detailed records of the data recorded to tape. If someone asks you for all of Mr. Smith's and Ms. Green's e-mail and Microsoft Office documents from 2001 to 2004, it's far easier to provide that information if you have detailed data about tape contents.
Keep a simple accounting system for your tapes. Know what your current inventory of tapes is. Add any tapes you've purchased, and keep purchasing records to back this up. Subtract any tapes that have been destroyed, and keep written destruction certificates. Simple math will show you how many tapes you should be able to account for.
Use a records management system to keep track of your tapes. Whether software or index cards, it should enable you to identify the location, content and status of every tape at any moment. The number of tapes tracked in your records management system should match the number of tapes in your simple accounting system. If your company has a records manager, you may already be doing this. If not, start now.
Consider using a bar-coding system. Many records management systems readily accommodate bar-code input, and this makes it easy to create records about the location and status of a tape.
Decide who should authorize the destruction of tapes. Then always keep a written record of each tape destroyed, along with the authorizing signature. This documentation, together with your policy describing your tape-destruction schedule, is vital to answering the killer question: "Why don't you have this information?"
Remember, backup tapes aren't really worth a million dollars each unless you've got a lawsuit on the horizon. Then they're priceless.
For more information please call (407) 265-6293 or visit us at: http://www.sencilo.com/prod-storagesoftware.php
About Us
Sencilo Solutions is a Florida-based integrator specializing in Cost Cutting storage, security and managed services solutions. Sencilo delivers a comprehensive portfolio of products from best-of-breed hardware and software from multiple manufacturers including VMware, Data Domain, EMC, Hitachi, Symantec, HDS, IBM, Commvault, Xiotech and HP. Its technical expertise is known throughout the storage and security industry. Clients include leading corporations, major financial institutions, top universities, government facilities, as well as small to medium size businesses. Sencilo's professional services include consulting, integration, project management, storage virtualization installation, maintenance and knowledge transfer.
Sencilo has offices throughout Florida including: Jacksonville, Daytona Beach, Tampa, St. Petersburg, Orlando, Hialeah, St. Augustine, Gainesville, Ocala, Palm Coast, Clearwater, Kissimmee, Lakeland, Maitland and Cape Canaveral Green Simpana Offerings Projects: BC DR planning Replication De-Dup De-Dupe iSCSI SAN NAS VMware Security EMC NetApp HP IBM Quantum Compliance VTL Data Domain vs Gartner Magic Quadrant Quadrent LTO Backup Exc Pure Disk NetBackup Networker TSM Commvault BakBone D2D D2D2T compare cloud data deduplication thin provisioning DXi Global Compression DDX virtual tape library Data Reduction SEPATON FALCON compare Celerra CLARiiON Equallogic Dell NS20 NS40 CX4 CX3-20 CX3-40 CX3-80 FAS2050 FAS3050 Xiotech Nexsan Avamar DLD3 1500 D3 Storwiz storage compression data Ocarina Networks A-SIS compare Sepaton infopro BlueArc OnStor Microsoft Unified Storage data protection StorageX Brocade FAQ SSD Solid state disk SANmelody FalconStor tier zero Xiotech ISE nx4 ax4 greenBytes ZFS Sun Top 10 ROBOBak managed services hosting cloud grid Datacore Compellent compellant equallogic lefthand networks don't buy storage stop buying storage itguardian cherub networks Arkeia Network Backup appliance Data Recovery Backup Health IT Healthcare IT Digital Hospital Allscripts
