TAPE LIBRARIES : INFORMATION MANAGEMENT FOR COMPLIANCE

Tape, the longstanding and faithful favorite for backup, remains a useful method for storing large amounts of data at moderate cost and in a portable format that can be transported offsite for storage of vital records. Tape libraries, sometimes called jukeboxes, have a tape drive, slots for cartridges, an automated means of loading tapes, and a barcode reader to identify tapes.

As described by Wikipedia, tape libraries are capable of storing from 20 terabytes to several petabytes of data, exceeding the capacity of a hard drive by ten thousand times over. Tape storage can save as much as 60 percent over the cost of hard drives, but the drawback is slower access time and limited random access.

Tape rotation is the practice of overwriting older tapes on a scheduled basis such as 30 or 60 or 90 days unless a tape must be permanently kept for archival or compliance reasons. Vital records or critical data for business recovery are frequently stored on tapes that are taken to offsite storage for protection, ready for retrieval as part of a disaster recovery plan.

There are some newer technologies that are giving tape some competition. A Virtual Tape Library or VTL is technology frequently used for archival storage, with a storage component, usually hard disk, that virtualizes the storage as tape hardware so that VTLs can be integrated with standing policies for archiving and backup. Many current VTL systems use ATA (Advanced Technology Attachment) or SATA (Serial ATA) disk arrays with the benefit of low cost and increased storage capacity.  When data is backed up to disks instead of tape, both backup and recovery may improve.  Depending on the data and circumstances, data on a VTL disk may be exported to tapes for disaster recovery purposes, according to Wikipedia.

MORE DATA, MORE COMPLIANCE

“Data is growing at 125 percent a year yet up to 80 percent of this data remains inactive in production systems where it cripples performance,” according to Charlie Garry, senior program director at the Meta Group in 2003.  “To compound this problem, many enterprises are in the midst of compliance initiatives that require the retention of more data for longer periods of time, as well as consolidation projects that result in significant data growth.”

A white paper by Paul P.Tallon, professor at the Carroll School of Management, Boston College, presents the idea that dealing with compliance can be turned into an opportunity for a company, and that IT personnel—as well as business executives—must be involved in policy decisions for compliance procedures. “The challenge for IT management and for storage in particular, is to take what is typically seen as an expense and transform it into an investment opportunity that can add value to the corporation,” states Tallon. Although federal regulations may mandate the retention of specific data or records for a defined time period, the answer is not to save everything. The issue with compliance is that the data can be retrieved in timely fashion if an investigation or need for discovery arises. Managers who are using ILM, Information Lifecycle Management, to classify their data may feel that once data has been archived, they are in compliance. Not so, unless they have procedures and controls for archived data as well.

With more companies appointing compliance officers, there will be more compliance  auditing by internal auditors, and data storage will come under more scrutiny. Tallon presents four key processes that build toward compliance.

•             Inventory of data used in key applications. Beyond backing up files, their content and role are also important.

•             Compliance readiness. Data should be grouped to meet specific compliance requirements. This means looking at how long files should be archived and how quickly they can be recovered, and the access controls for particular files.

•             Data protection policies which translate business requirements into policies that protect the information assets of the company while meeting compliance benchmarks.

•             Ongoing data management that supports compliance.  

The opportunity, as Tallon sees it, is this. “If compliance has any purpose, it is to force companies to recognize that corporate data has value and that they have an obligation to their stockholders to secure that data from theft, corruption and loss.” (Read this white paper at www.glasshouse.com.)

LOOKING AT THE COS T OF TAPE VERSUS DISK

An interesting analysis of the benefits and costs of tape versus disk is given in an article by Dianne McAdam of The Clipper Group (www.clipper.com) called “The Evolving Role of Tape in the Data Center.” Starting with the fact that more data has to be stored and held for longer periods of time, Adams points out that disks give fast access and are used for applications that have to be available 24 hours a day, and that disks are being used where backup windows are short for these 24/7 applications.

However, tape continues to be the practical backup choice for applications that do not have limited backup widows or stringent Recovery Time Objectives (RTO). Doing backups disk to disk, then migrating older backups to tape brings the economy of tape into the picture.

Tape has always been favored for its portability to off-site secure storage. But it also offers the economy of being able to absorb large data streams that are now part of life such as images from surveillance cameras, broadcast news events, and digitized medical images (one digitized X-ray may be 10 to 20 megabytes in size). Hospitals are required to keep such images for decades, with more such images piling on in years to come. Most of these images will likely not be accessed again, and thus tape is the logical and economical way to archive them.

Adams presents cost comparisons for buying a disk system versus a similarly sized tape system. She works with projected data growth rates and the storage that will be needed over a five-year period, going from 100 terabytes of storage in the first year to 207TBs needed in the fifth year. Knowing that 100% utilization is not realistic, she uses rates of 70% for disks and 85% for tapes. She uses prices from Quantum for its PX720/DLT-S4 tape library, drives and cartridges with a total of $147,750. She has priced an IBM DS4100 disk system with controllers, expansion units, expansion unit attachment features,  and racks totalling $757,175. Thus, the cost for the disk system is five times larger than that for tape.

Beyond buying the system, Adams also looks at the cost of powering and cooling each type of system. Cost per kilowatt hour varies greatly, with the coasts paying higher rates than the Midwest. Factors considered were power and cooling requirement for each unit times the number of units with the result multiplied by 8760 hours in a year times the cost per kilowatt hour.  The electrical cost for the tape system was $4,248 while the disk system would cost $49,386.

Why is electrical cost important? Because it is likely that rates will continue to rise year after year. Using an increase of 10% each year over the five  year period, the power and cooling cost for the disk system will be $301,507 while the tape system will cost $25,935. Storage hardware costs are coming down each year, and a buyer has many choices, but few if any customers have a choice of power suppliers.

Other long range costs to consider are the cost to replace disk or tape after several years, the cost of maintenance when the warranty expires, and the cost to backup or replicate data for disaster recovery.

Talk to your storage contractor to get more information on using tape for the particular needs of your organization.

 

Lack of Information Management Training Puts Organizations – and Their Customers – at Risk

A recent survey of information managers and human resources professionals conducted by ARMA International reveals that nearly half of the organizations are not training their employees on how to properly manage their records and information. Specifically, 45% do not provide formal training on managing corporate records and information. Almost half of those (46%) don’t have plans to implement such training in the near future. 

Good information management is critical to business continuity, regulatory compliance, and litigation readiness. As demonstrated in recent court cases and news reports, ineffective or mismanaged information – especially electronic information – can have devastating ramifications. It can cost an organization millions or even billions of dollars in penalties, as well as its reputation and, ultimately, its business.  

“The fact that so many organizations do not formally train all their employees on managing records and information – including the handling of sensitive data

– indicates that too many top executives don’t fully comprehend the risk,” says ARMA International Executive Director Marilyn Bier. “Information is a critical corporate asset. It’s also a major risk area. That realization must start at the top.”  

Respondents to the survey stated their information management training programs have been influenced most by recent news stories (49%), Sarbanes-Oxley Act and other regulations (48%), recent court decisions (46%), and the new changes to the U.S. Federal Rules of Civil Procedure (43%). In short, the Federal Rules state that organizations need to know what information they have, where it is stored, how to retrieve it. They also stress that employees must be trained on how to appropriately manage electronically stored information so that the company can meet its responsibilities.

Most of the organizations that provide formal information management training include e-mail (79%) and legal holds (75%) in that training. But only one-third cover voicemail as an information management risk area and even fewer (29%) address instant messages. Especially disturbing is the finding that 31% of organizations do not train their employees specifically about data security or protection of sensitive data. As for frequency of the training, 26% conduct the training annually, while 33% conduct it only upon request.

“The failure to institutionalize information management training – to take it to every desktop – leaves an organization vulnerable,” concludes Bier. “Policies alone are not enough. Each employee needs to understand why information management is important to the organization’s continued operation, what their role is, and the risks if it’s not done well.”

U.S. District Court Judge Shira A. Scheindlin, a key contributor to the new Federal Rules and the presiding judge in the often-cited case of Zubulake v. UBS Warburg, offered the following insight on the subject: 

It is well known that employees don’t read handbooks and manuals even when there is information there that is to their benefit. It is also necessary to require training of all new employees, and refresher training for all other employees.…An initial training session by department of all new employees, and then a semiannual training course might be good ideas.…A program that does not include a means of checking on employee compliance is no policy at all. Management must develop a system to ensure that employees are actually following the designated protocols. This can only be accomplished with a compliance monitoring program, which I think is an essential component of a records management policy.

ARMA International encourages organizations to conduct general information management training enterprise-wide to all its employees on a regular basis. Resources such as the Keeping Good Company training program, produced by Kahn Consulting Inc. and ARMA International, can help organizations with that effort. (See www.arma.org/learningcenter/goodcom-pany.) 

About the Survey ARMA International conducted the Information Management Training Survey in April 2007. Respondents included 502 records and information management professionals and 59 human resources information management professionals. The survey was conducted in cooperation with the International Association of Human Resources Information Management (www.ihrim.org), an association of human resources and IT practitioners, vendors, consultants, students, and faculty.

About ARMA International ARMA International (www.arma.org) is a not-for-profit professional association and authority on managing records and information. It is known worldwide for its development of standards and guidelines in this area as well as for providing unequaled education, publications, and information on the efficient maintenance, retrieval, and preservation of vital information created in public and private organizations in all sectors of the economy.

Formed in 1955, ARMA International is the oldest and largest association serving the records and information management profession. Its10,000-plus members include records managers, archivists, corporate counsels and other legal professionals, IT managers, consultants, and educators. Further, its members work in a wide variety of industries – including government, legal, health care, financial services, and petroleum – in the U.S., Canada, and numerous other countries. ARMA International also has more than 125 chapters that help to provide education networking on the local and regional levels.  

THIS IS AN IMPORTANT REMINDER

ARMA International and AIIM International are cosponsoring the 2005 Electronic Records Management Survey conducted by Cohasset Associates.

Your participation in this survey is VERY important.

Go to the Cohasset web site where, in only a few minutes, you can complete the survey.  http://www.cohasset.com/mer/survey/2005/

The opportunity to participate in this survey ends Thursday, May 17th (9 p.m. Eastern Time)

You should participate because the results can greatly benefit you. Here is how. The results of this survey will provide senior management with authoritative up-to-date survey research that:

1.                   Defines the key issues that records management professionals are seeking to address - particularly relating to managing electronic records,

2.                  Details the degree to which current records management programs need to be improved and provided with more resources "to do the job at hand", and
 

3.    Identifies the significant risks that exist when organizations do not have management comment to achieving "best practices" in the management of one of the key corporate assets, its records.

ARMA and AIIM also will co-sponsor a White Paper prepared by Cohasset that provides a comprehensive examination of the survey's results - including trends over time based on Cohasset's three earlier ERM surveys.

The White Paper seeks to present a "call to action" to senior management and thereby encourage greater focus, support and resources to enhance their organization's information assets. When published in July, it will be available to everyone without cost.

ARMA, AIIM and Cohasset believe that, with a better awareness in the issues and the risks, senior management will provide greater support to improving the funding of managing document-based information.

Take a few minutes to participate today.  This is a unique opportunity to "get the message to senior management."