proc9000-1405-SOP.doc

SBA Procedural Notice

This Notice consolidates guidance and requirements regarding data backup, and the protection of backup and recovery media.

To prevent loss of data from catastrophic events such as sustained power loss, fires or floods, it is vital that systems and data be backed on a routine basis. Issues that must be addressed in order to sustain a successful data and system backup and recovery program at the Agency include:

· Backups – Frequency of backups will depend upon how often data changes and how important those changes are. Critical data must be backed up daily. Offices need to document and enforce procedures on backing up and protecting IT resources.

· Labels – Backup and recovery media should be labeled for a variety of purposes, including controlling access, specifying protective measures, or indicating additional handling instructions. Labeling backup media also helps to prevent them from being accidentally overwritten.

· Storage - Backups should be stored securely. While stored on site, the media must be stored in fire-resistant containers. Backed up data should be moved to an off-site location at least weekly.

· Annual Testing - Backup copies should be tested to ensure they are usable. A test plan should be developed and executed at least annually to ensure that recovery is achievable. Based on the test results, the plan should be modified accordingly.

· System Configuration - System recovery is faster if hardware, software, and peripherals are standardized throughout an office. Although this may not always be achievable, compatibility contributes to ease of recovery.

· Interoperability - To facilitate recovery, backup devices must be compatible with operating systems and applications used in backup and recovery operations.

· Selection of Backup Media - Common media that can be used for backups include diskettes, tape cartridges, removable media (zip drives), compact disks, network storage devices such as networked disks, or server backups. Confidentiality procedures must be addressed prior to invoking any of these methods. In addition, it is important to ensure that the necessary hardware remains available to read backups or convert them to newer media if necessary.

There are a number of different types of system backups that can be employed:

· Full Backup – Stores all files selected for backup.

· Incremental Backup - Captures only files created or modified since the last backup.

· Differential Backup - Stores files that were created or modified since the last full backup.

· Disk Replication Backup - With disk replication, data is written to two different disks (a protected server and a replicating server) so that two valid copies of the data are always available.

To reduce the probability of a single catastrophic event such as fire or flood destroying both the operational data files and their backup, it is vital that backups be maintained at an off-site location. Selection of an offsite location should be based on completion of a formal risk assessment.

A number of off-site alternatives may be considered for backup and recovery capability, including: a dedicated site owned and operated by the Agency; a reciprocal site with an internal or external entity where a formal agreement has been negotiated; or a commercially leased facility. Iron Mountain, as an example, is the SBA’s current off-site storage solution.

Regardless of which type of off-site alternate site is used, there are six possible scenarios that apply for backup and recovery capability:

1. Cold Site - The facility has the necessary space and infrastructure support (electric power, telecommunications support, and environmental controls), but does not contain IT equipment.

2. Warm Site -The facility is partially equipped with some of the necessary IT equipment. It is maintained in an operational status ready to receive the relocated system.

3. Hot Site - The facility is equipped with all the necessary infrastructure and IT equipment to be immediately and fully functional. A hot site is typically staffed 24 hours a day, 7 days a week.

4. Mobile Site - A self-contained transportable unit that is custom-fitted with specific telecommunications and IT equipment necessary to meet defined requirements.

5. Mirrored Site - A fully redundant facility that has real-time information mirroring and is identical in all technical aspects to the primary site.

6. Iron Mountain Data Services – SBA has a contract with Iron Mountain Data Services to provide real-time online backup and recovery services for LAN/WAN, using Live Vault. Live Vault is an online backup and recovery service that is operational and monitored 24 hours a day to ensure that the data is available when needed. In the event of a catastrophic error, Live Vault provides recovery services via online tape and snap server.

Regular backups by System Administrators, associated backup documentation, and the process for securing administrative passwords should be established to provide a basic level of recovery capability in addition to incorporating any of the additional techniques emphasized above.

If you require additional information, please contact Lewis Baskerville on (202) 401-1980 or Joyce Lewis on (202) 205-6318.

Lawrence E. Barrett

Chief Information Officer

EXPIRES:1/01/2004

SBA Form 1353.3 (12-93) PerForm Version; previous editions obsolete.

Must be accompanied by SBA Form 58.