SP - 006 - Backup Policy

Storm Procurement Limited Policy Title:

Backup Policy

Policy No:

006

Effective date: 21st April 2021 Owner:

Version

1.02

Replaces

1.01

Services & Solutions Director

Introduction The purpose of this policy is to: • • • •

Safeguard the information assets of Storm Procurement Limited.

Prevent the loss of data in the case of an accidental deletion or corruption of data, system failure or disaster.

Permit timely restoration of information and business processes, should such events occur.

Manage and secure backup and restoration processes and the media employed in the process.

The retention periods of information contained within system level backups are designed for recoverability and provide a point-in-time snapshot of information as it existed during the time defined by system backup policies.

Backup retention periods contrast with data retention periods defined in the GDPR Data Register.

System backups are not meant for the following purposes: • Archiving data for future reference.

• Maintaining a versioned history of data.

Scope This policy and supporting procedures, encompasses all system resources and supporting assets that are owned, operated, maintained and controlled by Storm Procurement and applies to all servers and data (onpremise or cloud) that is managed by Storm Procurement.

Policy Details Overview This policy is set out to identify how Storm Procurement safeguards information in the case of data loss and to outline frequency and how long backups are retained.

Lines of Responsibility All users – Ensuring that data stored on Storm Procurement provided devices such as laptops is copied to the file servers ready for backup. Data on user devices are not backed-up unless copied to Storm Procurement file servers.

Helpdesk Manager – is responsible for ensuring that the backup policy is adhered to and any new systems follow this policy. Escalation is to the Services & Solutions Director [Storm Group].

Services & Solutions Director – has Board level responsibility for ensuring that Storm Procurement data is backed-up according to the business need.

Helpdesk Team – is responsible to the Helpdesk Manager and they:

April 2021 SP006_Backup Policy v1.02

1

Storm Procurement Limited

• • • • •

Ensure sufficient backup space is available.

Take overall responsibility for trust adherence to this policy.

Check the backup log for completion, be responsible for the safekeeping and availability of all back-up media and logs.

Perform test and live restores.

Report any backup failures to the Helpdesk Manager and log accordingly and investigate any reported exceptions.

Review of Policy Helpdesk Manager and the Services & Solutions Director are responsible for reviewing the backup policy annually or after a serious incident.

Systems Backup Storm Procurement has the following types of backup data: • • • •

File Servers – Unstructured data located on Storm fileservers Email – Email data stored on-premise on Exchange XXXX Databases – All structured data contained on the databases Virtual Machines – All data stored on virtual servers including the OS and data

Backup details of the various backup data types: File Servers • • Frequency: Daily • • What is backed up: Changed data • • Retention: ??

E-Mail • • Frequency: Daily • • What is backed up: Changed data • • Retention: ??

Databases • • Frequency: Daily • • What is backed up: Changed data • • Retention: ??

Virtual Machines • • Frequency: Daily • • What is backed up: Changed data • • Retention: ??

Exceptions are: • • ???

Transportation and Storage of Backup

April 2021 SP006_Backup Policy v1.02

2

Storm Procurement Limited

• • • • • • • •

All production backup data is stored at the Storm Procurement office in Watford and off site at the DR datacenter in Hemel Hempstead.

All backup data is written to disk.

File, Email, SQL backup data in maintained by ??Backup software??

Virtual Machine backups are maintained using ??Backup software??

All data is transported to the DR datacenter across encrypted VPN. File, Email and SQL data is stored on the production site for a minimum of XX days and a maximum of XX days. All other backup data is located offsite only at the DR datacenter.

All Virtual Machine backup data is located at the production site and the DR datacenter.

Expired backup data is automatically deleted.

Disposal of Media Storm Procurement only store data on disk and therefore the backup media is regarded as the disks storing the backup data.

•

•

Prior to retirement and disposal, the Helpdesk Team will ensure that: a) The media no longer contains active backup images b) The media’s current or former contents cannot be read or recovered by an unauthorized party Backup media (the disk storage holding the backup data) is destroyed and recycled by an approved WEEE Waste Carrier once it is no longer retained.

Validation •

• • •

Daily, logged information generated from each backup job will be reviewed for the following purposes: a) To check for and correct any issues b) To monitor the duration of the backup job c) To optimize backup performance where possible The Helpdesk Team will identify any problems and take corrective action to reduce any risks associated with failed backups.

Quarterly test restores from the DR datacenter will be carried out to verify the process works and that offsite backups are valid.

The Helpdesk Team will maintain records demonstrating the review of logs and test restores so as to demonstrate compliance with this policy for auditing purposes.

Data Recovery Requests for data recovery can be made by any of the below methods:

• • •

Email SD.SP@storm-technologies.com Call extension 8500 Visit the Helpdesk Team in person

April 2021 SP006_Backup Policy v1.02

3