S 1.59 Suitable siting of archive systems

Initiation responsibility: Head of IT

Implementation responsibility: Head of IT, Administrator

Since storage and archive systems contain important data of a government agency and/or company in a concentrated form, their IT components must be installed in secure rooms only accessible to authorised persons. Along with the servers and network components used, this particularly applies to the storage units (disk arrays, tape drives, disk jukeboxes).

All relevant safeguards described in the IT-Grundschutz Catalogues relating to the infrastructure security must be implemented to suitably install these IT components. Depending on the nature and size of the storage or archive system, modules S 2.1 General building, S 2.9 Computer centre, S 2.4 Server room, and/or S 2.7 Protective cabinets should be applied. In this connection, it is particularly important to ensure that the infrastructural components (power supply, etc.) are sufficiently reliable. When storage systems are used, appropriate redundancies in the technical infrastructure must be ensured (see S 1.52 Redundancy, modularity, and scalability in the technical infrastructure) in order to support the availability of these central resources in the best possible manner.

For the long-term storage of the archive storage media used, the storage conditions specified in S 1.60 Appropriate storage of archival media must be complied with. Above all, it is essential that the storage media as well as the archive systems themselves are properly air-conditioned.

Electronic archives are often implemented in such a way that the storage unit provides permanent access to the archived media. To this end, dedicated storage units are frequently used that can automatically administer and insert removable media, for example robots for tape drives or jukeboxes for disk media. If a storage or archive system contains such components, the archive media are generally never removed from the storage unit during their entire service life. This means that the storage conditions (in terms of air conditioning, access protection, etc.) required for the archiving media must be maintained and monitored inside the storage component already.

The criteria used to select a storage or archive system should therefore include that the required storage conditions for archiving media can be met inside storage components and/or what additional expense will be required to meet the storage conditions.

Review questions:

© Federal Office for Information Security. All rights reserved.