Re: Backup Policy

Perhaps your ISO 9000 could be shared with us when you get done.

The ISO 9000 people do have some guidance in computer resource management 
issues, such as software testing quality standards.  I know that is not what 
you were asking about, but it may be that they have connections such as 
examples of other company ISO 9000 computer standards you might want to copy.

http://www.qualitydigest.com/html/iso9000.html
http://www.sysmod.com/swdev.htm
http://ts.nist.gov/ts/
http://www.ieee.org/

Our Current Backup Policy could stand improvement, but how it currently 
stands, with respect to key actions that you might want to consider imitating.

1. We have off-site copies of our backups.  This is done in rotation, using 
odd / even end fiscal months, so that our SAVE-21 that will go off-site for 
the end of April will be made onto the EVEN months off-site tape before the 
ODD months off-site tape needs to come back into the building.  I need to 
review what paperwork is with this to make sure it still includes phone #s 
for our tech support, serial #s, account #s, the kind of data we would need 
if we did not have access to what is on the system.

I have periodically suggested that our PC backup policies be reviewed.
How do you know you backing up everything that should be backed up?
Should any of this be backed up off-site?
I make these suggestions to the heads of departments that have PCs whose 
applications are managed separately from what we have on the 400.

2. Sometimes we take stuff off-line.  Except for history archives which we 
probabluy might never ever need again, created as portion of writing off the 
oldest stuff, any software off-line goes on TWO tapes, so if something goes 
wrong with one media, it is not just in one place.

3. How do we know the backup worked & got everything it supposed to do?
One of the last steps of the backup is to READ THE MESSAGE that says the 
backup worked.  There have been some occasions when the message was something 
different, and we immediately took action to deal with that.

In the early days we did some inspections of what was on the media to be sure 
that we could rely upon the OS message.

4. Each time I get a new boss, I give a briefing on the various levels of 
security & how the company would go about locating master security passwords 
if I got hit by a union truck tomorrow.  My original suggestion was that this 
information would go in an envelope sealed in some SAFE or with company 
lawyers or auditors, to be opened if there is a future crisis with me, at 
which point this information would be needed by my eventual replacement.  
Management has placed this information in what THEY consider to be a safe 
place, and as far as I am concerned that is what is important.

5. We have some stuff that is extremely volatile with respect to multiple 
users, such as Query/400 definitions.  There is an intermittent problem in 
that someone deletes a query definition that they do not know anyone is 
using, when in fact one person uses that once a month.  By the time MIS is 
told there is a problem, the definition has been off-line for weeks if not 
months ... do we have a backup from which that can be recovered?  Was it 
deleted for good reason & should stay deleted?

I protect against this sort of thing by having copies of some software 
ON-LINE, which I replace every few months.

6. We have some ISO 9000 style documents.  They are for older hardware & 
software that is no longer used to run the company.  There needs to be a 
mechanism wherebye the folks who are in charge of these documents can be told 
by the people to whom they apply that this is in fact the case ... we do not 
use that system any more, it has been replaced by another system.

MacWheel99@aol.com (Alister Wm Macintyre) (Al Mac)


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---