On 11/28/06, Gerard J. Nicol <[log in to unmask]> wrote:
>
>
> We have been having an interesting discussion on the BareMetal List about
> what part RM people can and do play in the selection of an off-site data
> protection service.
The answer to this runs the gamut from providing advice to managing the
actual contracts themselves.
RM can be situated in a number of places within an organization, an
depending on how this arrangement is structured, the involvement can be VERY
direct.
Generally, RM is responsible for providing the guidance as to the
specifications that must be met for adequate protection of the media while
in the control of a third party, from the time it leaves the organization,
through it's transit, storage and management, and ultimately, its return to
the organization.
Many RM professionals have been involved in RIM (the 'I' being Information)
for an extensive number of years, and for this reason, have experienced the
physical management of media in house for their organizations. They have
also contributed to the development of policy, procedures and practices
related to setting rotation schedules, ensuring facilities are able to
provide proper environmental controls for media storage, inventory and
tracking systems, determining when encryption should be used (based on
content on the media), and also ensuring the appropriate form of destruction
is used for the media.
In instances when RIMs is under the CIO office, they are typically involved
in the management of ALL of an organization's Information Assets,
irrespective of media, form or format... because retention of records is
based on the content, NOT the form. An organization's retention schedule
applies to ALL records, whether they're stored onsite, offsite, in a central
repository, or in a distributed system. In these cases, any contracts of
storage of records, physical or electronic, are generally controlled by the
RIM. This would include establishing the specifications, evaluation of the
bids (and bidders facilities), determining the level of risk, and awarding
and managing the contracts.
In other instances, when the RIMs are in a "services environment", they may
be limited to providing the specs, evaluating the bids and recommending the
provider, then providing feedback on how well services are meeting the
contract provisions... but they are STILL involved.
I was just wondering given that this is the RM list what criteria RM people
> would use if they were given the opportunity to select a vendor in their
> own
> right.
Well, as mentioned, many times they ARE. And the last thing they look for
is convenience and price. The first thing they look for is service and
sufficient protection, along with a solid track record in serving clients.
A service provider has to be able to isolate their paper and media service
components in their offering... about the only thing that can be commingled
is billing.
Transportation needs to be independent, as does storage and the tracking
system. The vendor needs to have fully independent A/C systems for the
cargo area that are allowed to run all the while the vehicles are on the
road, communications and tracking systems in the vehicles, a second
custodian to stay with the vehicle at all times, systems to secure the media
while in transport (to minimize shock while moving), a static free
environment.
Of main interest, what chain of custody criteria would you look for?
The ability to scan in the media on receipt, on loading into the vehicle, on
removal from the vehicle, and on receipt at the facility... as well as once
placed into storage. And while it may cost more for storage, depending on
the volume of media (and naturally, the value of the information contained
on the media to the organization) I'd seek dedicated space where my media
would be stored independent of other customer's media.
That's my starting list...
Larry
--
Larry Medina
Danville, CA
RIM Professional since 1972
List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
|
