Skip to main content
Search

Recent Updates Fordham offices remain staffed and operating remotely. The University has released its plan, Fordham Forward, to resume in-person teaching and learning for the Fall semester. Full Details

Backup Policy

Version 1.0.1

Purpose

The purpose of this policy is to maintain data integrity and availability of the University's IT Resources to prevent loss of data due to deletion, modification, corruption, systems failure, and to facilitate the timely restoration of the IT Resources and business processes[1].

Scope 

This IT policy, and all policies referenced herein, shall apply to all members of the University community including faculty, students, administrative officials, staff, alumni, authorized guests, delegates, and independent contractors (the “User(s)” or “you”) who use, access, or otherwise employ, locally or remotely, the University’s IT Resources, whether individually controlled, shared, stand-alone, or networked.

Policy Statement

  • Backup activities must provide secure storage for IT Resources critical to the workflow of official University business.
  • Backup media must be secured.
  • Backups must be performed to prevent loss of data due to deletion, modification, corruption, systems failure, or disaster.
  • Backups must be retrievable as defined in the Recovery Time Objective (RTO) of the Information.
  • Backups must be taken in a manner to support the Information Recovery Point Objective (RPO).
  • Inventory of backup media must be maintained.
  • Backup retention should be in accordance with the University’s Records Retention and Disposal Policy.

[1] Policy scenario example: Backups of Information (data) support our business transactions (e.g., course registration, bursar payment transactions). Backups need to be done on a regular (i.e., daily, weekly) basis and stored securely. If our business systems are compromised (hacked), damaged (e.g., fire, flood), or incapacitated in any way, backups can be restored.

Definitions

Backup is saving or copying Information onto digital storage media.

IT Resources include computing, networking, communications, application, and telecommunications systems, infrastructure, hardware, software, data, databases, personnel, procedures, physical facilities, cloud-based vendors, Software as a Service (SaaS) vendors, and any related materials and services.

Related Policies and Procedures

Implementation Information

Review Frequency: Annual
Responsible Person: Director, IT Risk and Data Integrity
Approved By: CISO
Approval Date: May 16, 2017

Revision History

Version: Date: Description:
1.0 05/16/2017 Initial document
1.0.1 05/22/2018 Updated scope, disclaimer, and definitions

Policy Disclaimer Statement

Deviations from policies, procedures, or guidelines published and approved by the University Information Security Office (UISO) may only be done cooperatively between the UISO and the requesting entity with sufficient time to allow for appropriate risk analysis, documentation, and possible presentation to authorized University representatives. Willful failure to adhere to UISO written policies may be met with University sanctions.