Future Proof – Protecting our digital future

At this time of year, many organisations take the opportunity to clean out storage areas, including network drives and servers. We have received a few enquiries recently from organisations that would like to free up some space by deleting backups.

When making decisions about deleting backups, there are a few key things to consider:

Backup systems are not recordkeeping systems

Backups are used to recover data over the short term when it has been corrupted or destroyed by hardware or software failure, operator error or malicious action. The use of backups is a short term risk management strategy.

The Public Record Office Victoria has published a discussion paper which explores some of the limitations of backups and explains why you can’t rely on them beyond the short term:

Data stored in a backup system beyond the life of the creating system, or the system used to back up the creating system, is vulnerable. Essentially the problem is that the backed-up data needs to be interpreted by two layers of applications in order to recover meaning (the required information). The backed-up data first needs to be interpreted by the back-up software in order to restore the data as it was when the back-up was created. Then the application that used the data must be run to interpret the data and provide access to it. It will be unlikely that both of these applications will be available after a reasonable period to recover the ‘archived’ data.

Or as we put it in a previous FAQs post, backups are simply a cupboard into which you can put stuff. Just because you can put things into a cupboard doesn’t mean that you will be able to find them or open them or understand them or use them in the future.

The disposal of backups is covered by normal administrative practice (NAP)

Backup tapes are covered under the normal administrative practice (NAP) provisions of the State Records Act 1998, which allow for the disposal of certain types of facilitative and duplicate records. Schedule 2 of the State Records Regulation 2015 provides more information on what constitutes NAP in a public office.

In our advice to NSW public offices, we recommend that organisations establish backup schedules in consultation with relevant IT and business areas. Recovery requirements, and hence backup cycles and strategies, may vary depending on the risks associated with particular systems and the business activities or processes they support.

Make sure that employees know about, and are using, corporate recordkeeping systems

Before disposing of backups, it may be necessary to establish that employees are capturing records in corporate recordkeeping systems and not relying on backups for access. You could, for example, advise employees that backups are going to be destroyed on a certain date, so if they think there are any records (such as email messages or documents) that have not yet been captured into a corporate recordkeeping system, they should do so before the destruction is carried out.

As an example, at State Records we have a program to capture documents, email messages, snapshots of our website, publications etc in our electronic document and records management system (EDRMS). We refer to the EDRMS when looking for records, not backups. Our IT section manage backup tapes for business continuity, and wipe tapes regularly according to an established schedule.

And finally, remember that chickens are not an appropriate method of destruction!

Just in case you were tempted to use chickens to destroy records in any form, think again.

Information about appropriate methods of destruction for different record formats, including digital media sanitisation, is available in our advice on destroying records.

Image credit: Martin Abegglen – “Happy Chicken” (CC BY-SA 2.0)