On 4/2/07, Nolene Sherman <[log in to unmask]> wrote:
>
> More and more of our vendors are providing reports via CD ...  have
> suggested
> that our IT folks upload the CD's primarily so that they are backed up
> and secondarily for usage.


A good suggestion, I see nothing wrong with it in principle.  The CD becomes
the backup, and maybe when IT uploads it, they can assign a "pointer"
stating where the physical CD is stored.   One additional comment I would
make here is if the vendors have unilaterally made the decision to provide
information to you in this form and it isn't in keeping with what they were
contracted to provide (or if it costs YOU MORE to process it because they
provide it in this manner), you may need to speak to them about this.


One of the attorneys wondered if that was necessary. He thought that we
> could just find out how long the vendor kept the data themselves and
> rely on that for the backup or have them send us duplicate copies of the
> CD which could then be sent to our offsite storage vendor. His primary
> concern of uploading seemed to be that it may make the data less secure.




YOW... I'm surprised an attorney would be willing to rely on the vendor as a
source for "backup" seeing as if you had a legal issue with them, you'd be
asking them to provide evidence against themselves =)   I think I saw this
movie sometime in the past....


My knee jerk reaction was that it would be no less secure than anything
> else on our network and perhaps more secure than the notebook holding
> the CDs in the desk drawer or file cabinet, that sending copies of CDs
> to "storage" would not be good for the CDs unless we used
> environmentally controlled storage (these records have a 10 year
> retention -- not very long, but long enough, in my mind, to be aware of
> degradation), and that it would be inefficient to manage since only one
> or two CDs would be eligible for destruction each year.



Not "knee jerk", the reaction of a practiced RIM!  Of course it wouldn't be
any less secure than anything else you have on line.  And yes, it's MUCH
more secure than relying on CDs in a binder on a desk or in a drawer. And
while 10 years isn't a REAL LONG TIME, if these are "100 to the spindle
quality CDs" it IS a long time.  CDs stored for backups should be free of
writing on the surface, stored in jewel cases, in an upright posture in an
area with a stable temperature and humidity, away from shock, dust, and
excess light.

And if money is no issue and you have the space, contact
www.firelock.comand ask about a custom media vault, but if you're a
bit smaller than that
and your volume can't justify the best, then take a look at
www.schwabcorp.com and consider a 4 hour rated media safe for a couple of
thousand dollars.  We have two of these and I used to sell them (in a past
life) and can tell you they're a great investment.

My second
> reaction was that to rely on a vendor to provide backups is not a great
> idea -- what is the vendor's responsibility ($1.00 per box?), what is
> our exposure if it's lost, etc.


I think the attorney was referring to the vendor who provided the data to
you, but if you're referring to "they who shall remain nameless", yeah, you
bet a self manged repository is a better bet.

What are other folks doing with records provided on CDs. BTW, we do not
> have an EDMS in place.


Irrespective of having an ERMS/EDMS, you should still have a means of
protecting media, either with an off site storage provider that can
guarantee proper levels of protection designed specifically for media, or at
minimum, a media safe stored away from your primary repository of on site
paper records in an office area protected by sprinklers with reasonable
environmental controls in place as well.


Larry

-- 
Larry Medina
Danville, CA
RIM Professional since 1972

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance