Q: Carolyn Mariani, CRM: "Has anyone ever run across the requirement to keep
system back-ups (e.g. monthly tapes) across all servers for 7 years because
of SOX, or any other reason?  Is there a SEC ruling or white paper that
documents what is the best practice in this situation?"

=========================

A: Hi Carolyn,

John is correct, there is no such requirement from a governmental entity
which would apply across the board and there is unlikely such a requirement
broadly for any particular industry which might be regulated including the
SEC which is required to implement rulings comply with Sarbanes Oxley.

What you might be hearing from someone in your organization is that Section
802 of the Sarbanes Oxley Act of 2002 has a requirement that, and I'm
generalizing here, records be retained for seven years for audit which
include among other things, all workpapers and then it goes on to make a
very broad definition of workpapers.  That's a over generalization, but it
gives the feeling of a requirement if your organization falls under
circumstances to which this applies.  With the lax way many organizations
maintain information which often certainly include elements of or whole
records, it's not unusual for companies to relate the huge amount of data on
backup tapes, especially if the company has been storing them for years and
years, to Sarbanes Oxley out of fear that information may exist only on the
backup tapes.  

This perspective is problematic if there is no initiative to improve
information governance and recordkeeping in general because the costs to
search the backup tapes in a worst case scenario could be extreme.  Worst
case scenarios are like tornadoes, that is they only hit occasionally and
most people aren't in their path .... but they could hit anyone.  So
companies continue with risky policies and with a good intention to make
improvements.  Until improvements are actually made, keeping the backup
tapes for seven years may offer them a general timeline after which old
tapes might be destroyed with theoretical comfort that they have seven years
of everything (except maybe hardcopy forms of information of course which
may not be on the backup tapes!)

I hope that helps.  I believe the issue of using backup tapes for retention
remains a significant one today.

Tom

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]