I'd like to echo and amplify some of the points made here already.

First, make sure that you understand the difference between backups and
archives. 

A backup is something created specifically for business continuity
purposes. Backups are generally created on a daily basis and
incrementally build a library of changes over a period of time. Most
organizations will do a "full" backup once a week (generally on a
Friday or Saturday night). The subsequent backups then only copy the
files that have changed since the previous successful backup run. Most
organizations will retain four or five sets of backups (i.e. a full
backup plus all the incremental backups until the next full backup). In
our organization, this is a 28 day process. Since the backup process is
governed by an IS policy -- and because backups are not being retained
for record-keeping purposes -- we do not have these on our retention
schedules, as such. Backup tapes can be evidence and are subject to
litigation holds. We have a process in place to suspend rotation of
backup tapes in the event of litigation. Taking this step is very
well-considered and will result in some immediate meetings between
counsel and IS to attempt to identify relevant servers and the related
media. It also results in some very expensive purchases of additional
backup media since the regular media can no longer be rotated. Because
of the expense, litigation hold on backup media is not done on a whim
and we take steps to immediately limit the scope of the hold, if
possible.

Archives are media which are retained as records. The problem is that
many organizations don't have a good plan to retain archives of their
electronic systems under a proper records retention plan. In many
cases, they are permanently retaining what some companies would call
"backups", simply because they have had cases where a senior executive
deleted a file on a server and realized the mistake six months later --
commanding the IS department to keep "backups" of the servers
indefinitely.

In both cases, regular testing of the data capture and restoration
process is essential. Most organizations that have not done testing
find that their backups and archives are unreadable when they are
needed. Therefore, if you are placing a litigation hold on tape media,
you want to ensure that your IS team can read and restore the data when
/ if needed and that they are able to identify the source for every
tape, as well as the date when the tape was created.

Litigation holds trump all retention periods. When ordered by counsel
to cease destruction of records and rotation of backups, that has to
happen without fail across the board. The next step is to work with
counsel to determine what is in scope for the litigation hold. In some
cases, the hold may be necessarily broad, but in most cases, the hold
can be limited to certain information, systems, or files relating to
people or events.

Patrick Cunningham, CRM

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance