against failure, preservation programmes must also consider the risks of a

disaster which damages all copies stored at the same site. Storing copies at
different sites is a basic requirement; to avoid the impact of region-wide
disasters such as floods, earthquakes, wildfires, and war, programmes should
consider the need to store additional backup copies of important data outside
their own region.
Preservation programmes may also need to adjust normal backup schedules so
that preservation data, which must be kept, is refreshed (i.e. rewritten) not
overwritten with new data.
System security. Security controls are required to ensure that stored data are
only exposed to controlled, authorised processes. Standard IT security
measures for vital information assets are fully applicable and absolutely
required.
Disaster planning. Standard IT disaster recovery plans must be in place, and
must be tested regularly. The plans may include realistic arrangements for
attempting data recovery from damaged carriers, but data recovery is
expensive and uncertain, and it should be seen as a very unsatisfactory
alternative to proper recovery-from-back-up arrangements.

16.12 Managing risks

Table 16-2 presents a simplifed risk analysis of some of the more common threats to
data in storage.

Threat What it Likelihood Speed of Impact Prevention

affects onset options
Natural data almost certain gradual data may not error checking, error
generation of integrity work; may correction, data
errors prevent data refreshing and
recovery transfer
Carrier data certain for gradual severe; data use high quality
breakdown integrity most carriers may be products; use more
unreadable stable carriers; check
and not condition frequently;
recoverable transfer data within
expected life of
carrier
Malicious data almost certain likely to be likely to be security measures,
attack: integrity, file for networked sudden severe; may logical and physical;
hackers, identity archives include firewalls, access
virus, rewriting or controls; take data
intruders corrupting offline
data
Collateral data varies, likely to be likely to be backup data; secure
damage from integrity, file depending on sudden and severe, and access to backups
other attacks identity, situation unexpected beyond
not directed equipment capacity of
at system assets normal
security
measures

115