On 4/26/05, Roach, Bill J. <[log in to unmask]> wrote:
> >>just make a note in your diary to avoid using low cost, ineffective
> vendors and support a vendor who actually wants your business enough to
> do it right."<<
>
> I know this list takes great pleasure in throwing darts at Iron
> Mountain.  But lets look at it from the other side.  Based on their
> calculations, IM does about 5 million pickups and deliveries a year.
> Let's say that we have about a quarter of the year done.  That makes
> about 1.25 million deliveries done as customers expected, with four
> problems.

Good points Bill, but were the deliveries really made as expected? Now
here is a question for all (and it is vendor neutral) "How many of
you audit your offsite storage vendor?" That's right how many out
there regularly audit the processes and the procedures used by your
offsite storage vendor to ensure that what they say they are doing is
being done? If your contract has a SLA (service level agreement)
attached/associated with it, do you regularly monitor and assess the
level of service provided?

In her testimony before the US Senate Banking Committee on March 10,
2005 Barbara Desoer of Bank of America testified that "...none of the
tapes or their containers bore any markings or information identifying
our company, the nature of their contents or their destination. Nor
are any of the personnel involved in the shipping process aware of the
nature of the materials being shipped. As to the tapes themselves,
sophisticated equipment, software and operator expertise are all
required to access the information. In addition, specific knowledge of
the manner in which the data is stored -- that is, the "fragmented"
nature of the data and the steps required to reassemble it -- would be
required."

She also testified that the "investigation, which continues today,
included a detailed review of the entire transit process for the
shipment, including the archive vendor, truck drivers, airline
personnel and Bank of America employees."

http://www.senate.gov/~banking/_files/desoer.pdf

How many folks out there know their exact process? While encryption is
a great idea there may be some restrictions on its use. For example it
is my understanding that data held within an Oracle database can not
be encrypted.

so what are the lessons learned here
1. Know your process intimately
2. Audit the process
3. Continously improve the process
4. No process is foolproof

--
Peter Kurilecz
Richmond, Va

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance