Reply to selected SNIPS from Gerard's post on Friday. Since other
addressed other issues I will only reply to the ones I see value for
this Listserv.
>> I personally do not believe there is a line up of vendors willing
>> to assume
>> financial liability. What I think is that you are saying that
>> there is so
>> people will think it is the norm and start doing it.
Owner managed media vaulting companies must carry liability
insurance. Many of the requirements for bidding on large accounts is
that they carry insurance. Many of the contracts overseen by Records
Managers who oversee the tape storage program demand proof of
insurance. New insurance will soon be on line to offer even better
levels of protection. Yes there will be new costs associated with it.
>> Your logic behind a vendor assuming financial responsibility and
>> therefore
>> providing better service is flawed.
HOW Can you think otherwise?? I am aware of several incidents where
Owner Managed operations had losses over our 21 years in the business
and in each instance the client received well above the $1.00 per box
that contracts state so it is impossible to contract away all
liability. That is why Owner Managed facilities carry insurance,
otherwise the very first loss would put them out of business. Due to
this heightened risk, the Owner Manager is everywhere at once in the
operation. This supervision is why you are not reading daily
articles about losses among the Owner Managed data vaulting centers.
>> (1) If a vendor did lose a tape they would be less likely to
>> disclose that
>> fact if they would be financially damaged.
Their exposure under the Identity Theft laws would be astronomical if
they go beyond 45 days. You go from minimal liability to contingent
liability in one cover up. All their contract exclusions would be
useless in the face of these new laws.
>> Instead they would probably try
>> and cover the loss up rather than notifying the customer so that
>> they could
>> take appropriate action.
I have seen no one behave in this way since these new laws went into
effect. That is why we are seeing some companies take such a
beating. They don't want to admit it but their legal department is
forcing them to avoid a path of liability.
Management of tapes is first and foremost a function of great
managers taking a personal and vital interest in knowing the location
of every tape they store and deliver. That is why I am such a strong
proponent of selecting Owner Managers on site at every Media Vault
location. But on top of that, as Steve described, a records manager
or IT Manager must also take responsibility on a daily basis.
You are not reading the news and studying what is happening with this
new legislation. 82% of Fortune 500 Corporations feel they have a
disconnect in records management for media; which is what the laws
are demanding protection for. Most feel that "Data Mapping" is non-
existent with current IT skills. Records Managers are the ones
solving these problems. FILENET has some solutions in this area
which is why IBM bought them. There are other companies that have
software to read tapes and convert it into a inventory with retention
schedules and with searchable terms. I have mentioned them
previously. Voila! "Data Mapping."
In a talk I gave in Denver I displayed what a leading consultant to
Corporate Boards and Auditors stated about the strong need for the
insertion of RM into the IT function. You may have no faith in
records managers but I see only hard working and continually educated
managers trying to protect their organization. The Denver Chapter was
especially astute. Who else will management look to?
>> (2) In most cases the chain of custody is so weak at both ends of the
>> transaction that it would be difficult to prove who lost the tape(s).
But Steve's answer covered this issue of catching lost data very well.
You write software and procedures for a tape tracking software,
proper tracking and management can be administrated if you have
someone who cares doing it. Are you saying it can't be done or that
some aren't doing it?
There are weaknesses in some offsite media storage programs but a
Certified Media Vaulting Center would eliminate many of these and
that is why I am working to develop this network. Look at the
success NAID has had with their Certified Destruction Centers. They
are getting the job done. Superior management at every center. You
notice that this is an industry controlled by smaller, owner managed
and very professonal companies.
When I got into vaulting 21 years ago, people told me "No one has an
interest in Vaults that protect media, only paper." We proved that
false a long time ago.
Experts said media vaults won't work because the media is so
fragile. So we worked with Liebert and CargoCaire to develop Vaults
that could hold 68º F and 30% RH so the media life-span would be
increased.
We added magnetic shielding as this was a source of loss in some
situations.
But everyone told me that no one needed those things but today there
are 1,200 plus sites across the country. 72 individual companies have
used our vault in the offsite storage industry to protect their
client' media. Digits to Dust was a national disgrace but we had a
solution to decaying media. And records managers were at the
forefront of this issue.
I am continually looking for technology solutions to security
problems. I see RFID coming into play. It gets better every day.
FileTrail RFID has a great solution for tracking records into and out
of a vault. The good media vaulting companies are looking to provide
clarity in what they offer and they will soon offer special captive
insurance which the good and great can afford to provide and the
slacker types will avoid.
I am talking with insurance consultants that can provide a new level
of protection. We will model what we plan to do on some successful
companies out there. Will every body do it? No only a few at first
but we are in this for the long haul.
> Taking the time to select a good
> vendor and then being eternally vigilant of their performance is
> the only
> solution to the problem.
I do agree with you here. Many, given a choice between a large
service provider and a great service provider; will choose the large
one because they don't trust themselves to evaluate the difference.
But this is not unique to RM's, the IT Managers have done the same
thing. The articles about losing tapes are starting to wake up some.
A few years ago we started installing Server Vaults to protect the
processing platform. Every time a new loss of data occurs, we get a
spike in phone calls for this capability. These are CFO's that
believe that, if there is no way to protect the data door step to
door step and while in storage, they must take dramatic action.
What we really need is records managers and IT Managers who demand
responsibility. I was amazed the guy who found out his media was
being moved by package shipper not his records storage companydid not
include a quote to the effect that: "We are immediaitely looking for
a different vendor!"
If your records center was bought out in the last five years and the
acquiring vendor is no longer delivering with their own personnnel
and your records are no longer local then you may have just
quadrupled your risk, as you now have additional hand off that occur
in each direction. You hand it to the delivery company, the delivery
company moves your media through a big logistics center where
everything is mixed together, it then is placed on a second truck who
then hands it to the records storage company. To get it back repeat.
The environmental damage alone makes this a bad plan. You have lost
software control and accountability. Immediately review your
contracts and strike this ability from the contract.
Look for a tremendous increase in problems with this program. But
most importantly, when a real disaster occurs what happens then?
Having your disaster recovery tapes 2 1/2 hour or more away is a real
problem when you want a one hour recovery.
I would suggest that every member of this List go tour where their
box records and media are stored. Ask to see your specific media.
Set up a audit trip in advance. Take some ID Tracking Numbers with
you and ask to see those. Many of the companies I work with set up
special rooms for just this.
If you don't tour and audit your records storage centers then you are
not being accountable. Sooner or later this will lead to your
downfall. I recently read an article where an offsite media storage
company claimed they had an 8 hour rated media vault. It would take
one audit tour to disprove that. That claim will stay out there
until someone tours their vault and asks "Where is your certification
of that?" or "How can your vault be rated for eight hours when the
building it resides in is rated for only 4 hours?" or even a simple
"Could you please show me your UL Test Label for an 8 Hour Class 125
Vault?" But I have seen others claims of 10 hours and 12 hours????
These claims go away when one good records manager or IT Manager
walks in and ask for your Certification.
Insurance coverage will make all this go away as the insurance
company will send a specialist to review the facility and verify that
what they are insuring is really there. Previously there weren't
enough vendors doing a unified program to interest the big insurance
companies. But now there are. Plus the certification process will
provide a detail listing of what is being provided. Tell me people
wouldn't pay more to have this coverage versus "We lost your tapes!
You should have encrypted!" Or, "We didn't lose your tapes, the
vendor we hired to move them back and forth lost your tapes." Or,
"The records that were lost in the fire were inactive records."
Data Mapping of all records is a new reality in the industry and
records managers will play a role here.
We are going to have a beautiful Spring so RM's get out of your
office and go visit your records.
Peter and Jesse, maybe you could talk about where the need for Data
Mapping is going to take us. We should be talking about that.
The better prepared you are for discovery and ediscovery the more
litigation proof you become. This will also cut your legal fees
enormously. Also some law firms will look at your situation and feel
you are a lost cause so preparation is important.
Hugh Smith
FIRELOCK Fireproof Modular Vaults
[log in to unmask]
(610) 756-4440 Fax (610) 756-4134
WWW.FIRELOCK.COM
List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
|
