Back-up Policy & Guidance
Document Control Document Details Author Adrian Last Company Name The Crown Estate Division Name Information Services Document Name Back Up Policy Version Date 10/10/12 Effective Date 1 November 2012 Issue THREE Review Date October 2013 May 2007 Change Record Modified Date Author Version Description of Changes 14/05/2010 Clare Kelly 1.1 Incorporates comments by ZH, TB, CK and NS 04/05/2011 Roberta McCaughan 1.2 10/05/2011 S Smith 1.3 Review for Service Desk 13/07/2011 S Smith 1.4 Change made to 4.1. See ISMS 2011 Audit Action List for information. 21/07/2011 S Smith 1.5 Change made to 4.2. See ISMS 2011 Audit Action List for information 10/08/11 A R Last 1.6 Final review 10/10/12 A R Last 1.7 Annual review Stakeholder Sign off Name Position Signature Date Nigel Spencer Information Services Manager July 2011 Clare Kelly IT Support Manager July 2011 Nigel Spencer Head of IS October 2012 Security Sign-off Name Position Signature Date Adrian Last Business Support Manager August 2011 Adrian Last ISMS Manager October 2012 1
Table of Contents 1. Purpose 3 2. Scope 3 3. Policy 3 3.1. Policy Statement 3 3.2. Policy Objectives 3 3.3. Policy Overview 3 3.4. Policy Maintenance 4 4. Policy Requirements 4 4.1. Build Documentation 4 4.2. Server Imaging 4 4.3. Identification of Data for Back-up 4 4.4. Back-up Schedules 5 4.5. Restoration 5 4.6. Software Compatibility 5 4.7. Back-up Retention 6 4.8. Media Storage 6 4.9. Reporting Security Incidents 6 4.10. Business Continuity 6 4.11. User Awareness 6 5. Disciplinary Process 6 6. Deviations from Policy 6 7. Glossary of Terms 6 Appendix A - List related documents, procedures and processes 7 2
1. Purpose The purpose of this policy is to ensure that The Crown Estate s electronic information resources are backed-up at scheduled intervals to suitably secure storage media in order to facilitate the restoration of all or part of those information resources in the event of loss or corruption of the original data. 2. Scope The scope of this policy applies to: Any of The Crown Estate s premises where electronic information is stored; and Information system resources, including data networks and servers located at May The 2007 Crown Estate and non-crown Estate locations, where these systems are under the jurisdiction and/or ownership of The Crown Estate, and any servers authorised to access The Crown Estate s data networks. Out of Scope: The Crown Estate is not responsible for backing up non-crown Estate machines. The Crown Estate IT Service Desk also does not back up PCs or laptops. Users should always save data to servers. i.e. data on users laptops and PCs is their own responsibility. It should be noted that personal drives on individual PCs and laptops will not be backed-up. Only data stored on corporate servers is subject to this Policy. 3. Policy 3.1. Policy Statement The Crown Estate s information system resources are assets important to The Crown Estate s business and stakeholders and its dependency on these assets demands that appropriate levels of information security be instituted and maintained. It is The Crown Estate s policy that appropriate back-up measures are implemented to protect its information system resources from loss or corruption, and to maintain appropriate levels of confidentiality, integrity and availability of such information system resources. 3.2. Policy Objectives The objectives of this policy with regard to the protection of information system resources against loss or corruption are to: Minimise the threat posed by the potential loss or corruption of electronic information owned by The Crown Estate or temporarily entrusted to it; and Minimise reputation exposure, which may result from the loss or corruption of The Crown Estate s electronic information resources. 3.3. Policy Overview The Crown Estate information system resources are important business assets that are vulnerable to loss or corruption due to technical failure, human error or malicious attack. It is therefore essential to ensure that verified back-ups are taken in order to be able to restore lost or corrupted data to its original state at a specified point in time. 3
3.4. Policy Maintenance Supporting standards, guidelines and procedures will be issued on an on-going basis by The Crown Estate. Users will be informed of any subsequent changes or updated versions of such standards, guidelines and procedures by way of e-mail or other relevant communication media. Users shall then have the obligation to obtain the current information systems policies from The Crown Estate intranet (i-site) or other relevant communication media on an on-going basis and accept the terms and conditions contained therein. 4. Policy Requirements The Crown Estate s information system resources shall be backed-up at scheduled intervals in order to provide assurance of restoration in the event of loss or corruption of data May 2007 and for business continuity planning purposes. 4.1. Build Documentation The IT Service Desk will document and build processes and test recovery routines to mitigate risks of data loss. 4.2. Server Imaging Where appropriate, disk images will be taken and stored in order to provide for the most rapid restoration of mission-critical servers to a known state. The IT Service Desk will document build processes and test recovery routines to mitigate risks of data loss. 4.3. Identification of Data for Back-up Data will only be backed up when requested via a Back-up Application form sent to the IT Service Desk, along with a Request for Service (RFS). No assumption should be made that data is being backed up unless a Back-up Application form has been completed and acknowledged. Emergency or special back-ups may be requested by contacting the IT Service Desk in writing. 4.4. Back-up Schedules The production environment must not be impacted by the running of back-up jobs. All back-ups must be created, scheduled and run according to the performance and availability requirements of the environment. Back-ups are scheduled as one of the following: Daily Weekly Monthly Annual (both calendar year-end in December and financial year end in March). Archive Once-off According to standard definitions of terms, back-ups are determined as: Full Differential Incremental 4
Back-up logs will be reviewed daily by the IT Support Team and failures logged by the IT Service Desk for onward investigation. Tests will be conducted to investigate the cause of back-up failures and action taken accordingly to prevent recurrence. 4.5. Restoration Test restorations will be conducted by the IT Support Team at regular intervals using a disparate cross-section of application types to ensure that back-ups are working correctly and that restorations can be successfully executed. Requests for restoration of live systems must be logged with the IT Service Desk. Requests for full system restores must be accompanied by a high priority call and Change Control Approval. May 2007 Where possible, restores are made initially to an alternate location, and then copied to the live location following verification. Where restoration is to a live system and the system is not terminally corrupt, the existence of a suitably-recent back-up is confirmed in case the restoration fails. Where no suitably-recent backup exists, a back-up is taken first. Users will be notified of the outcome of the restore. 4.6. Software Compatibility A secure library of application software versions will be maintained for as long as corresponding back-ups are retained in order to ensure that a compatible version of the software will be available for use if the need arises to restore an application to a pre-upgrade state. 5
4.7. Back-up Retention Back-ups are retained in accordance with the following periods of time: Back-up Schedule Daily Weekly Monthly Annual Archive Once-off Retention Period Minimum 1 month Minimum 2 months Minimum 3 months 6 years Indefinite As requested 4.8. Media Storage Back-up tapes are collected and stored offsite by an appropriately-resourced third party contractor. Tapes held temporarily onsite are stored in a controlled, secure environment. 4.9. Reporting Security Incidents All security incidents, including significant back-up or restoration failures, should be reported immediately to the IT Service Desk. 4.10. Business Continuity Business continuity plans shall include provision for the restoration of information resources from back-ups. This document is supported and guided by the Business Continuity Plan for IS. 4.11. User Awareness Users shall be made aware of this Policy and all its provisions. May 2007 5. Disciplinary Process The Crown Estate reserves the right to audit compliance with the policy from time to time. Any disciplinary action, arising from breach of this policy, shall be taken in accordance with The Crown Estate s Rules and Disciplinary Code as amended from time to time. Disciplinary action may ultimately lead to dismissal. 6. Deviations from Policy Unless specifically approved, any deviation from this policy is strictly prohibited. Any deviation to or non-compliance with this policy shall be reported to the ISMS Manager or Head of IS. 7. Glossary of Terms The terms used in this policy document are to be found in the ISMS Glossary of Terms. In particular, a back-up is defined as a copy of a specified subset of The Crown Estate s electronic information resources. 6
Appendix A - List related documents, procedures and processes Backup Checklist Procedure Backup and Recovery Process Business Continuity Planning Policy/Procedure Disaster Recovery Policy/Procedure Business Continuity Plan for Information Systems Department The Crown Estate s Rules and Disciplinary Code May 2007 7