Boiling Down 201 CRM 17.00 for Online Backup

There continues to be frantic analysis of 201 CRM 17 - the Massachusetts regulation for Protection of Personal information. The regulation requires not only thorough data protections measures, but also requires documentation and auditing of those measures. As with any new sweeping regulation, there is much speculation as to the effects. Here we've boiled down the verbiage to help clarify the top line requirements.

The implications for online backup?

Backed up data requires the same processes that the original data requires. Data must be encrypted and transit and at rest and secured using a comprehensive password policy. Specific personnel must be assigned to manage the process. The days of unencrypted backup devices and tapes will soon be over.

(17.02) The regulation applies to those who have personal information about residents of the Commonwealth of Massachusetts. That information is defined primarily as name with one or more of these: social security number, driver’s license number, financial account number, credit or debit card, or access codes that would permit access to financial accounts.

(17.03) Some highlights of the plans include: (letters match corresponding paragraphs in the regulation)
Developing and maintaining a plan with these aspects
a. Designating specific employees to design and maintain the plan
b. Identifying assessing internal and external risks to the data or the overall security of the plan.
c. Have specific policies for telecommuters
d. Impose measures for violation of the rules
e. Prevent terminated employees from accessing records
f. Make sure third party providers have the capacity to protect data
g. Collect the minimal amount of personal data required and give access to the smallest number of persons
h. Keep an inventory of where the data is kept
i. Regularly monitor and audit employee access
j. Revue the plan at least annually.
k. Document responsive actions taken in connection with any incident.

(17.04) On the technology side of the equation, there are additional requirements that describe user identification ID. passwords and the control of those.

If you want the research, see these links. The deadline for compliance was recently extended from January 2010 to May 2010.

Links:
The actual regulation 201 CMR 17
FAQ Issued by the Office of Consumer Affairs and Business Regulation (dated 11/2009)
Article on 201 CMR 17 in CSO Magazine

Nothing Static About Backup

There's nothing static about backup. Among the talk of simplified backup, easy backup and set-it-and-forget-it backup, the reality is that our data changes often and in many ways. Even the best automated backup solutions require intelligent oversight to stay on top of the changes.

How does data change?
Sure, data on our computers changes daily with new and changed information added to our data sets: a new proposal, updated data bases, changed graphics or diagrams. Most of these changes are covered by an automated backup that backs up common folders. The concern arises is when other changes happen. Here are a few examples:

Software application updates - Many of our customers rely on industry specific applications such as MISys for manufacturing, DentiMax for dental offices, Amicus for attorneys, etc. Once the backup for these applications is set up, people assume that the data files remain in the same folder and are backed up on schedule. The challenge comes when users install updates to the software. We recently were called to help restore data for a medical office that had installed such an update. The new software changed the location of the data files for that software. The new location was not included in the original backup set. So when the computer crashed and we restored the data, none of the data since the update were available. Ugh!

Operating system updates - Depending your backup configuration, you may or may not backup operating system files. In either case the way the operating system works with your backup solution is important to understand. As we mentioned earlier this month, backup with Windows Vista and 7 can be much different that those with XP. So whenever you change or upgrade your operating system review the backup sets to be certain critical data is protected.

Changing computers or networks configurations - Of course changing computers or changing the network location for critical data should prompt a review of the backup set. And be sure the backup set includes that actual data files, not just a shortcut to the file.

We recommend a test of your backup, including restoring a test file, once a month. A full review of backup sets should be done quarterly and whenever one of the events listed above occurs. The best backup solution in the world doesn't replace common sense and familiarity with the working environment.