The importance of creating a backup of a computer system's data cannot be overstated. A backup provides a means by which the data can be restored if it is accidentally deleted or destroyed (perhaps by user mistake, computer hardware failure, or a disaster). For user error or hardware failure, locally stored backups will suffice. As part of a disaster recovery plan, however, off site backups are important to minimize the chance that a disaster (e.g., a tornado) destroys both the original computer system and its backup media. This document discusses alternatives for off site storage of university data backups.
University data placed on backup media should be encrypted before taking the media off site in order to minimize the risk of a data exposure. If it is not technically feasible for the data to be encrypted, it is imperative that the physical security afforded the backup media be formidable.
To minimize personal liability, it is also important that backup media not be stored at an IU staff or faculty member's place of residence. Indiana state laws make employees, in some cases, criminally liable for sensitive data exposures (e.g., in the event that backup media is lost and/or stolen in transit to, or while stored at, the employee's place of residence).
The preferred method for solving off site storage needs is to go with an established vendor who offers such a service. IU Purchasing has arranged an off site storage contract with Recall that is available to all schools and departments across all campuses of the IU system. Recall offers several drop off and pick up options, and the cost of this service is based on the frequency of those arrangements as well as the number of media stored off site.
If Recall does not meet your needs, Iron Mountain could be a viable alternative.
Several IT administrators at IU have entered into reciprocal agreements with administrators in other units at IU to store off site backups at each other's building or facility. This is by far the most affordable approach to solving off site storage needs.
However, there are risks associated with this type of agreement. First and foremost, the IT administrator that is now the caretaker for the other administrator's backup media has assumed additional risk and must ensure that the backup media is stored in a secure location while in her/his possession. The backup media must also be protected while in transit between the two facilities. In addition, the two sites (i.e., the building housing the original system and the building housing the backup media) must be remote enough to minimize the chance that a single tornado (or other such disaster) would destroy both facilities.
Read this article, Stolen computer tape holds state employees IDs from the Columbus Dispatch for an example.
If you are a Local Support Provider (LSP) at Bloomington or Indianapolis and would like to arrange a reciprocal agreement with another LSP, please engage other LSP's via UITS LSP Services' LSP Online Forum.