Regulations & Info for Disaster Recovery & Business Continuity

Health Industry: Covered Entities (CEs) must maintain reasonable and appropriate
administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of their electronic protected health information (EPHI) against any reasonably anticipated risks.

Public Companies: The Securities and Exchange Commission (SEC) rules state that public companies must maintain “Reasonable safeguards for information” and for availability. The Board of Directors and senior management will be held accountable.

E-Commerce: Consumer Credit Protection Act (CCPA) section 2001 Title IX mandates
availability of data in Electronic Funds Transfers including Point of Sale.

All Businesses: IRS Procedure 86-19 requires offsite protection and continuous availability of computer records containing any tax information.


Redundant Array of Independent Disks (RAID), which provides disk redundancy and fault tolerance for servers, is a popular hardware technology that uses an array of disks to provide failover services.

Six RAID levels are available, with each level providing a different method of failover configuration. (RAID-1 and RAID-5 are the most common deployments). RAID is useful for keeping local servers available to users.

Disk replication, in which data is written to two different disks (the main server and the backup server) to ensure that two valid copies of the data are always available. Disk replication can be performed locally or between two locations.

Two data replication techniques are available:
1. Synchronous (Mirroring). This method uses a disk-to-disk copy, applying changes to the backup server at the same time changes are written to the main server. This method can degrade performance on the main server, and should be implemented only over short physical distances (within the local LAN) where bandwidth will not restrict data transfers between servers.

2. Asynchronous (Shadowing). This method continuously captures data changes in the main server to a log, and writes the log to the backup server. This is the recommended mode for offsite replication. Electronic vaulting, where the server is connected to an electronic vaulting provider to create automatic backups offsite. Data is transmitted to the electronic vault as changes occur on the server between regular automatic backups. The data can be restored to the original server, or another server (which can be in another location).
Remote journaling, where transaction logs are transmitted to an offsite location, either continuously or through batch uploads. The logs are used to recover changes that occurred after the last server backup has been restored.

To properly protect yourself from a devastating loss of data, your planning for business continuity must involve more than computer data recovery through a restore process. To ensure that your business can continue to operate, your disaster recovery
plan must focus on maintaining uninterrupted business operations.

For more info, visit www.neverfailgroup.com