Illustration by Jørgen Stamp digitalbevaring.dk CC BY 2.5 Denmark
Introduction
Digital preservation is not simply about risks. It also creates opportunities and by protecting digital materials it means that new or extended value can be derived from them. It can be easy to become overwhelmed with risks, so It is worth being explicit early in the process about what opportunities are being protected or created. There are many things that put your digital resources at risk including changes to your organisation or technology. If not managed, these risks will have a significant impact on your ability to carry out your digital preservation activities, wider business functions, or comply with legislation.
To manage digital preservation, you must understand your organisation's specific issues and risks. You can do this by undertaking a risk and opportunities assessment. The assessment will highlight specific risks to the continuity of your digital resources, and opportunities that can be realised from mitigating these risks.
Risk management
Experience shows that the risks facing digital resources are subtle and varied. They include, but are not limited to the following:
|
|
Data loss is likely to have a variety of real world consequences depending on context. In the context of a court case, for example, the authenticity of a document could become a significant legal issue; whereas for highly structured research data the chain of custody may matter less than access to explanatory context that enables the reproducibility of an experiment. In many contexts it may be technically possible to recover digital collections but where an organisation simply doesn't have the wherewithal or skills necessary to restore a data set, then practical obsolescence and data loss can result. This is likely to become more of a reality as the number and complexity of digital collections expand.
The risks to digital content usually matter because of their consequences in the real world. Again this depends on the context but the following can occur:
- Loss of reputation.
- Inadequate resources for a critical task.
- Inability to support users in their activities.
- Failure to discharge legal or regulatory function.
- Inability to exploit and reuse data.
- Loss of identity and corporate memory.
- Cost of recreation and recovery.
Risks are typically prioritised by calculating a 'risk score' based on likelihood, impact and imminence: an imminent risk with a strong probability and a large negative impact needs prompt action. Depending on the nature of the risk this might include taking steps to reduce the likelihood of a risk emerging, reducing the impact if a risk does occur, or buying time for mitigation steps to be implemented.
Risk assessment is an ongoing process that can be developed and expanded through time. It can help bring together different stakeholders and, because risk management is understood by senior management it can also help to make the case for investment. Even an elementary risk assessment will highlight priorities for anyone getting started in digital preservation.
Finally it is worth noting that digital preservation is distinctive in being long-term and most risk methodologies are typically focussed on the short-term. For digital preservation, you need to be aware that over the long term improbable events will become more likely and special attention should be paid to those with significant consequences.
Business continuity planning
Rationale
'Interested parties and stakeholders require that organizations proactively prepare for potential incidents and disruptions in order to avoid suspension of critical operations and services, or if operations and services are disrupted, that they resume operations and services as rapidly as required by those who depend on them.' (ISO/PAS 22399:2007).
Business Continuity planning and practice is well-established within the IT profession and is not dealt with in detail in the Handbook. However it is an important component of ensuring bit preservation and makes a significant contribution to digital preservation through this. There is a series of webinars on business continuity and digital preservation from the TIMBUS project (see Resources).
The development and use of a business continuity plan based on sound principles, endorsed by senior management, and activated by trained staff will greatly reduce the likelihood and severity of impact of disasters and incidents.
One model is the plan developed by the Data Archive, and described in the DPC Case note on Business Continuity. Organisations may also wish to consider use of cloud services (see Cloud services) as part of their planning.
Requirements
- Develop a business continuity plan.
- Ensure all relevant staff are trained in business continuity procedures.
- Create copies of data resources at the time of their transfer to the institution.
- Store copies on industry standard or other approved contemporary media.
- Store copies on and off site. Off-site copies should be stored at a safe distance from on-site copies to ensure they are unaffected by any natural or man-made disaster affecting the on-site copies.
- Consider data and skills as assets and compile registers of them.
- Ensure roles and responsibilities are identified and maintained.
Resources
ISO/PAS 22399:2007 Societal security - Guideline for incident preparedness and operational continuity management
http://www.iso.org/iso/catalogue_detail?csnumber=50295
This standard provides general guidance for any organization to develop its own specific performance criteria for incident preparedness and operational continuity, and design an appropriate management system.
ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security management systems -- Requirements
http://www.iso.org/iso/catalogue_detail?csnumber=54534
This standard specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system. The requirements are generic and are intended to be applicable to all organizations.
Disaster Preparedness for Digital Content
http://dpworkshop.org/workshops/management-tools/disaster-preparedness
A Digital Preservation Management workshop webpage that links a set of 4 suggested documents (disaster plan policy, communications plan, training plan, roles and responsibilities). Cumulatively they provide comprehensive documentation and are updated to reflect current practice for disaster preparedness.
National Archives Risk assessment tools
The National Archives provide two excel format self-assessment tools that link to its digital continuity guidance and framework of solutions and services.
The Self-assessment tool (0.4 Mb) divides the risk assessment into three sections: Understanding digital continuity and roles and responsibilities; Information requirements and technical dependencies, and Management
The Information asset risk assessment tool (0.26 Mb) helps you identify risks to the continuity of any specific digital information asset and identifies where continuity has already been lost. It makes recommendations on maintaining or restoring continuity to help you develop a digital continuity action plan.
DRAMBORA (Digital Repository Audit Method Based on Risk Assessment) Toolkit
This is an online toolkit for a digital repository audit. The toolkit guides users through the audit process, from defining the purpose and scope of the audit to identifying and addressing risks to the repository. DRAMBORA provides a list of over 80 examples of potential risks to digital repositories, framed in terms of possible consequences.
SPOT
http://www.dlib.org/dlib/september12/vermaaten/09vermaaten.html
The SPOT (Simple Property-Oriented Threat) provides a simple model for risk assessment, focused on safeguarding against threats to six properties of digital objects fundamental to their preservation: availability, identity, persistence, renderability, understandability, and authenticity. The model discusses threats in terms of their potential impacts on these properties, providing several example outcomes for each. The article describing the model also included a useful comparison of other digital preservation threat models.
Managing digital continuity guidance from The National Archives
Includes a helpful risk assessment with many correlations to risk management strategies for Business Continuity Planning.
Assess and manage risks to digital continuity
The National Archives have built a self-assessment tool for the wider public sector that links to its digital continuity guidance and framework of solutions and services.
Assess risks to digital continuity factsheet
http://www.nationalarchives.gov.uk/documents/information-management/assess-dc-risks-factsheet.pdf
(2 pages)
Risk assessment handbook
http://www.nationalarchives.gov.uk/documents/information-management/Risk-Assessment-Handbook.pdf
(35 pages)
The Atlas of Digital Damages
https://www.flickr.com/groups/2121762@N23/
This is a staging area for collecting visual examples of digital preservation challenges, failed renderings, encoding damage, corrupt data, and visual evidence documenting #FAILs of any stripe. You can contribute just an image, tell the story behind the image, or share the original file (or set of files), so that tool developers can learn from digital damage and test out their code with it.
TIMBUS project: Business Continuity Management 1 - Intro, Life Cycle, Planning, Scope
https://www.youtube.com/watch?v=25EhtuE3XkE
1 of 4 Business Continuity Management and the Digital Preservation of Processes webinars from the EU-funded Timbus project. This introduction is probably the most accessible for novices (released 2013. 13 mins).
Case studies
DPC case note: Business continuity procedures – UK Data Archive, University of Essex
The Data Archive is the UK national data centre for the Social Sciences funded by the Economic and Social Research Council (ESRC). The Archive holds certification to ISO 27001, the international standard for information security, which requires information security continuity to be embedded in an organisation's business continuity management systems. The digital storage system at the Data Archive is based, for security purposes, on segregated and distributed storage and access. Business continuity at the Data Archive is based around the resilience provided by creating multiple copies of the data and specified recovery procedures, alongside pre-emptive failure prevention. Each file from any dataset has at minimum three copies. The Archive also creates a read only archival copy of each study and any update as it is made available on the system.
References
ISO, 2007. ISO/PAS 22399:2007. Societal security - Guideline for incident preparedness and operational continuity management. Available: http://www.iso.org/iso/catalogue_detail?csnumber=50295