As a company we are performing daily backups onto RDX removable media which is fully encrypted (shows as unformatted drive) and the backup software also encrypts the files during the backup process, both encryptions are 256bit and different passwords. One of two directors stores the RDX removable media at their home in a fireproof safe. The RDX media is switched before going home each day and then transported in the director’s company/personal vehicle.
The problem we are facing is a compliance issue, some of our existing customers and potential new customers have flagged our procedure as inappropriate and I have now been asked by the directors to look at tweaking our existing system or finding an alternative. Here’s what I have been considering as tweaks to our existing stagey…
Audit and chain of custody: We have the resources and skill to create an audit for pickup, transport and delivery and I was also thinking of adding GPS tracking too.
Outsourcing to external company: This would certainly give an audit trail and chain of custody with secure location, but the cost of £480 per month is something we would like to avoid.
Here’s what I’ve been considering as alternates…
NAS backup to a fireproof/waterproof device: I have issues with this as it doesn’t sit well in a business continuity plan as compliance requires an alternative location.
Cloud backup: I want to avoid this and will only go with this if it’s the last option. The problem is that the customers flagging our procedure as inappropriate have been non-specific so some initial feedback regarding our process would be helpful, plus alternatives and tweaking suggestions.