É«ÖÐÉ«

Purpose: SCC IT will provide policy-based, system level, network-based backups of server systems under its stewardship. Working with the É«ÖÐÉ« Computing Community and its business functions.

Applicability: The goals of this backup policy will be as follows:

• To safeguard the information assets of the É«ÖÐÉ« Computing Community.
• To prevent the loss of data in the case of accidental deletion or corruption of data, system failure, or disaster.
• To permit timely restoration of information and business processes should such events occur.
• To manage and secure backup & restoration processes and the media employed within these processes.

Definitions: SCC IT will implement backup policies on a per system basis that define:

• Selections: What information is to be backed up on systems.
• Priority: Relative importance of information for purposes of the ordering of backup jobs.
• Type: The frequency and amount of information to be backed up within a set of backup jobs.
• Schedule: The schedule to be used for backup jobs.
• Duration: The maximum execution time a backup job may execute prior to its adversely affecting other processes.
• Retention Period: The time period for which backup images created during backup jobs are to be retained.

Definition of Retention Period

The retention periods of information contained within system level backups are designed for recoverability and provide a point-in-time snapshot of information as it existed on SCC IT-maintained systems during the time period defined by system backup policies.

Backup retention periods are in contrast to retention periods for information defined by legal or business requirements.   System backups are not meant for the following purposes:

• To archive data for future reference
• To maintain a versioned history of data

Default Schedule of Backups

Unless a system supporting an application or business function requires a custom schedule, SCC IT will backup systems using a default schedule of weekly full backups and subsequent differential-incremental backups prior to the next full backup.

During backups, point-in-time images of information stored in active, permanent storage (e.g. hard disks) will be copied to magnetic tape or other media over a private network or virtual private network medium.

Full backups will back up all files specified within a system’s backup policy, regardless of when they were last modified or backed up. Differential-incremental backups will back up all files that have changes since the last successful incremental or full-backup.

The media containing a system’s weekly full backup and full set of subsequent differential-increment backups will comprise its weekly full backup media set.

Through use of weekly full backups and subsequent differential-incremental backups, backup windows (time period required to perform backups of one or more systems) will be minimized as will be the number of media required to store the backups. This will assist in ensuring good system performance for business processes.

Restores will require a longer period of time as the last full backup and all differential-incremental backups that have occurred since the last full backup are required. However, due to the frequency of backups, at most one week of tapes would be required in the event of a complete system failure.

Thus, this policy works to minimize the time required to backup systems (the common case) while limiting the potential time required to perform a full-system restore in the event of a system failure (the uncommon case).
 
SCC IT will schedule backup windows for systems so as to minimize disruption to academic and business functions and ensure accomplishment of the weekly full – daily differential-incremental policies described above.

Systems Covered

SCC IT backups only cover centralized server systems managed by the SCC IT department.  This includes but is not limited to:

• E-mail servers
• Network Share Servers
• Database Servers
• College-wide web servers

Systems not covered by SCC IT backups include:

• Faculty or staff workstations and laptops
• Data saved to computer lab machines or Tech Carts
• Non-IT managed servers
• Any systems not owned by É«ÖÐÉ«

Individuals concerned about backing up data on systems not covered by the SCC IT backup policy should submit a request to the helpdesk for a stand alone backup plan.

Retention Period of Backups

Unless a system supporting an application or business function requires a custom retention period, SCC IT will maintain 2 weeks of full and incremental backups. SCC IT will also maintain a full backup from the start of each academic semester. 

SCC IT will identify problems and take corrective actions to reduce any risks associated with failed backups.

Test restores from backups for each system will be performed at least every two months. Problems will be identified and corrected. This will work to ensure that the backup procedures work properly.

SCC IT will maintain records demonstrating the review of logs and test restores so as to demonstrate compliance with this policy for auditing purposes.

Systems Management

SCC IT will ensure on an on-going basis that all elements of its backup system are documented and maintained in such a manner as to ensure:

• The integrity and confidentiality of data copied during backup and restore operations
• Appropriate access to data maintained within the backup system
• Recoverability in the face of system failure or disaster
• Optimal performance
• Stability

Elements of the backup system requiring ongoing systems management include, but are not limited to:

• Client software
• Hardware drivers
• Server software
• Network connectivity & communications
• Storage devices (e.g. SAN or NAS drives)

Restoration Requests

In the event of accidental deletion or corruption of information, requests for restoration of information will be made through processes defined within SCC IT’s Technology Help Request Policy.

As the restoration of information has security consequences including:

• Possible escalation of privileges by parties authorized to access information
• Access by non-authorized parties

SCC IT will carefully verify that the request for restoration of information is authorized by the owners of the information prior to performing the restoration.
SCC IT will additionally ensure that the information restored is restored to a file system location with access controls appropriate to the information being restored.

Degradation of Service

Should a failure or defect of the backup system threaten the recoverability of a computing system or its information, SCC IT will take immediate actions to correct the situation.

Additionally, SCC IT will attempt to warn all users and owners of applications & information of the failure or defect and the potential scope of information loss.

SCC IT will work with those warned to mitigate potential or actual risks until such time as full-service can be restored.

Disaster Recovery Considerations

As soon as is practical and safe post-disaster, SCC IT will:

• Restore existing systems to working order or obtain comparable systems in support of defined business processes and application software.
• Restore the backup system according to documented configuration so as to restore server systems.
• Obtain all necessary backup media to restore server computing systems
• Restore server-computing systems according to the priority of systems and processes as outlined for restoration and recovery by:
  • É«ÖÐɫ’s Continuity of Operations Plan

or

• The point-in-time direction of É«ÖÐɫ’s senior management

Procedure:
Requests for software in the labs must be submitted to the Help Desk prior to July 1 in order to be installed and maintained by IT for any fall semester: Program requests prior to December 1 for any spring semester: Program requests prior to April 1 for any summer session.  Failure to submit software installation requests by the deadlines may result in overtime being charged back to the department making the late request.
The Help Desk is to be notified prior to the purchase of any software to be installed on SCC computers. At the time of acquisition, the following documentation must be submitted to the Help Desk:

• Number of licenses
• Copy of license agreement
• Access to software documentation and installation instructions
• Any support agreement contacts and renewal information

Policy Owner: Dr. Mark Baas                    Policy Owner Contact Number:  (507) 332-5876     

Date of Policy Adoption:  1/25/2015