Template Archiving and Purging Requirements

Overview

This questionnaire supports the gathering of business requirements by providing a template with detailed questions to be answered and filled in. The template is provided as file to be used with any word processor - this is a distinct advantage compared to printed templates.

The resulting documented requirements are essential for IS/IT to design and implement an appropriate backup-, archiving and restore processes.

This document strives to contradict following

CMU - Common Misunderstanding

There is nothing to be specified by business because backup and archiving is a standard service of IT, backup is switched on by UNIX-team and archiving is done by the database administrator (DBA).

As costs for backup and archiving (including repeated testing of data backed up and archived by restoring and recovering!) will exceed the storage costs on your production system, strong influenced by the protection level required from business, backup and archiving requirements are an essential part of the requirements.

As those business requirements can have significant impact on the application design and deployment architecture it is of essential importance that those requirements are known from the very first beginning of the project.

CMU - Common Misunderstanding

We don't know now how long we need to keep the archived data, IT must keep them until we will tell them to remove old data.

As there are laws LIMITING the MAXIMAL retention period this general decision could already violate laws! To allow IS/IT to formulate technical requirements (e.g. for an RFP) business needs to deliver

for backup and recovery purpose:

Recovery Point Objective (RPO): maximal acceptable loss of data (last <x> hours/days) and quantification of financial damage.
Recovery Time Objective (RTO): Time to restore operations for different level ("incident","disaster")

for archiving and restore purpose

Requirements for Retention Period per data type
Requirements for restore of archived data and access to the restored data

To be able to deliver this information following pre-requisites need to be executed by business in advance:

Data Classification
Legal and regulatory constraints for each data type (customer, employees, usage/consumption, assets..), where appropriate on attribute level.