Data retention, is tape OK? 62



  • This post is deleted!


  • This post is deleted!


  • This post is deleted!


  • This post is deleted!


  • This post is deleted!


  • This post is deleted!


  • This post is deleted!


  • besides sox. a tape is nothing where you want to store something on for a longer period. That’s because tapes, if there not used regulary will ‘blood-through’. That means that the tape layers on the reel start to adhere together. If you want to store/archive data over a longer period you should use optical data storage mediums. Storeing, archiving requires also to regualry check the storage medium if it is still usable/readable.



  • I agree with the above poster.
    DDS and other forms of magnetic tape are NOT long term storage solutions.
    General accounting practises dictate: life of the document plus 7 years.
    As part of Sox Compliance your company should develop a Document Retension Policy and a Data Classification Scheme.
    For example for security logs such as access logs we require logs are retained 6 months activiely and 2 years on tape. We are willing to take the risk of tape decay in the case of log files.
    For critical accounting data (defined by the business) we keep the data on optical media for minimum of 7 years. Some SEC specific data we keep for longer.
    I understand the expense of long term storage of data. Many storage companies shouted with glee when SOX passed.
    The best advice I can give is really work with business to limit the number of documents that are critical to financial reporting. [/quote]



  • I’m a computer tech and we’re just starting to get into SOX compliance at my company.
    Now correct me if I’m wrong, but I seem to remember seeing a test somewhere that showed that if you weren’t very careful in selecting the type of optical media, it’s possible that the data would not be readable after even one year.
    They were having the same problems with that people were having with tapes.



  • My take on the data storage issue is you need to establish a control process that tests the tapes or other media on an annual basis and replace as needed. If you can demonstrate that you do that, you have covered the SOX requirement.



  • That should be covered by a general IT Control (Cobit) within your SOX effort.



  • besides sox. a tape is nothing where you want to store something on for a longer period. That’s because tapes, if there not used regulary will ‘blood-through’. That means that the tape layers on the reel start to adhere together. If you want to store/archive data over a longer period you should use optical data storage mediums. Storeing, archiving requires also to regualry check the storage medium if it is still usable/readable.
    I am surprised to see some of the views about tape. And wonder how what type of tape is being discussed and with how much in depth technical knowlege. Todays midrange and enterprise class, servo tracked tapes are highly reliable. Both tape substrate and binder chemistry is stable with reliable access to data for over 30 - 40 years. Although I am not exactly sure what is being described above as ‘blood-through’ is. I suspect that ‘Stiction’ is being described. Stiction has occurred on old open reel tapes, stored in high humidity conditions, these conditions would degrade any data storage medium, including disk. With regards to SOX and tape. I deal with many of the worlds largest Datacentres (in the finance and banking sectors), most of whom are working with Auditors, such as PWC, to ensure compliance. For these guys tape is an essential component of their record retention control structure. With regards to non erasable formats, these are available (STK 9x40 volsafe for example), however SOX does not require such. The SEC and FSA may require that certain records are kept on a WORM technology. Should any user want more document information surrounding this subject, I would be happy to assist.



  • I believe current tapes are quite reliable. At least 10 years I would say… Nevertheless you need an internal IT control (annual or monthly based procedure) to verify that stored information is accessible and reliable.
    BTW, you may also need a procedure for dealing with tape destruction. 😉


Log in to reply