Backup Policy
Version 3.0
For Students, Faculty, Staff, Guests, Alumni
Purpose
The purpose of this policy is to ensure data integrity and availability of the University's IT Resources, to prevent data loss within the limits of records retention requirements, and to facilitate the timely restoration of the IT Resources and business processes.
Scope
This IT security policy, and all policies referenced herein, shall apply to all members of the University community, including faculty, students, administrators, staff, alumni, authorized guests, delegates, and independent contractors (the “User(s)” or “you”) who use, access, or otherwise employ, locally or remotely, the University’s IT Resources, whether individually controlled, shared, stand-alone, or networked.
Policy Statement
- System Owners must perform system state backups1 at a frequency sufficient to support the Recovery Point Objective (RPO) and Recovery Time Objective (RTO).
- System state backups must be retained for no less than 90 days and no more than one year unless otherwise stated in the Records Retention and Disposal Policy
- Annually, System Owner(s) must perform, at a minimum, a random sample test restoration of system state backups to verify backup reliability, information integrity, and the ability to meet the defined RPO and RTO.
- Test results and identified corrective actions must be documented and retained in accordance with applicable University records retention requirements.
- Application Owner(s) or Business Analyst(s) with specific knowledge of the IT Resource should request all other types of backups (i.e., pertaining to business requirements) per the Backup Requests Procedure and meet the Records Retention and Disposal Policy, business, and research requirements.
- Backup inventories must be maintained by the System Owner(s) and must identify the IT Resources covered, backup frequency, retention period, storage location, and responsible owner.
- Backup information must be protected against unauthorized access, disclosure, modification, and deletion in accordance with the applicable security requirements.
- Backup copies for IT Resources identified as critical through applicable business continuity or disaster recovery processes must be maintained separately from the operational environment to reduce susceptibility to a single disruptive event.
- Where a third party provides backup or restoration services, System Owner(s) must ensure the service meets applicable RPO, RTO, retention, protection, and restoration testing requirements.
- System Owner(s) must ensure IT Resources can be restored to a known operational state following a disruption, compromise, or failure within applicable RPO and RTO requirements.
1 System state backups save or copy information onto digital storage media to restore the server or system to a functioning state.
Definitions
Application Owner is the individual or group responsible for ensuring all the services that comprise an application accomplish the specified objective or set of user requirements. If a third party provides these services, the Application Owner is responsible for maintaining the relationships with the third party providing the service.
Backup is a copy of information or system state maintained to support recovery or restoration.
IT Resources include computing, networking, communications, application, telecommunications systems, infrastructure, hardware, software, data, databases, personnel, procedures, physical facilities, cloud-based vendors, Software as a Service (SaaS) vendors, and related materials and services.
Recovery Point Objective (RPO) is the maximum acceptable amount of data loss measured in time. It is the age of the files or data in backup storage required to resume normal operations if a computer system or network failure occurs.
Recovery Time Objective (RTO) is the maximum desired length of time allowed between an unexpected failure or disaster and the resumption of normal operations and service levels. The RTO defines the point in time after a failure or disaster at which the consequences of the interruption become unacceptable.
Restore/restoration is the process of returning data or IT Resources that have been lost, damaged, compromised, or otherwise made unavailable to a known operational state or moving data to a new location.
System Owner is the individual or group responsible for the procurement, development, integration, modification, operation, maintenance, and retirement of the server, operating system, or other elements that support an Application Owner providing services. The System Owner provides the technical infrastructure for system state and data retention backups. If a third party provides these services, the System Owner is responsible for maintaining the relationship with the third party providing the service.
NIST SP 800-53 Rev. 5 Controls
CP-1 - Policy and Procedures
CP-9 - System Backup
CP-9(1) - Testing for Reliability and Integrity
CP-9(2) - Test Restoration Using Sampling
CP-9(3) - Separate Storage for Critical Information
Contingency Planning: CP-1 Policy and Procedures; CP-9 System Backup; CP-9(1) Testing for Reliability and Integrity; CP-9(2) Test Restoration Using Sampling; CP-9(3) Separate Storage for Critical Information; CP-10 System Recovery and Reconstitution.
Related Policies and Procedures
- Backup Requests Procedure
- Business Continuity and Disaster Recovery
- Records Retention and Disposal Policy
Implementation Information
| Review Frequency: | Triennial |
|---|---|
| Responsible Person: | Senior Director of IT Security and Assurance |
| Approved By: | CISO and CIO |
| Approval Date: | May 16, 2017 |
Revision History
| Version | Date | Description |
|---|---|---|
| 1.0 | 05/16/2017 | Initial document |
| 1.0.1 | 05/22/2018 | Updated scope, disclaimer, and definitions |
| 1.1 | 08/17/2020 | Updated policy statement, added definitions |
| 1.2 | 04/27/2022 | Updated policy statement |
| 2.0 | 08/30/2023 | Updated purpose, scope, policy statement, and policy disclaimer |
| 3.0 | 09/14/2026 | Strengthened backup frequency, protection, restoration testing, inventory, third-party backup services, and system recovery requirements; aligned NIST SP 800-53 Rev. 5 controls to CP-1, CP-9, CP-9(1), CP-9(2), CP-9(3), and CP-10. |
Policy Disclaimer Statement
Deviations from policies, procedures, or guidelines published and approved by Information Security and Assurance (ISA) will only be considered cooperatively between ISA and the requesting entity with sufficient notice to allow for conducting appropriate risk analysis, documentation, review, and notification to authorized University representatives where necessary. Failure to adhere to ISA written policies may be met with University sanctions up to and including dismissal.