| Craig S. Mullins
|February / March 2009
by Craig S. Mullins
When data professionals think about regulatory compliance we tend to consider only data in our production databases. After all, it is this data that runs our business and that must be protected. So we work to implement database auditing to know who did what to which data when; or we tackle database security and data protection initiatives to protect our data from prying eyes; or we focus on improving data quality to ensure the accuracy of our processes.
These are all worthwhile endeavors, but focusing exclusively on active, production data is insufficient to ensure compliance. Improved backup and recovery practices and procedures must be an essential component of your compliance plans.
Ensuring the integrity and availability of your databases is the primary focus of backup and recovery planning. Indeed, as I have written here before, recoverability must be the primary objective of every DBA – not performance, as some assume. After all, it should be easy to achieve fast performance to inaccurate (or worse, non-existent) data, right?
But what about compliance and regulations? Let’s examine database recovery through the lens of COBIT.
COBIT is a framework of IT best practices that companies can use to improve management over their IT organizations, to improve the value of IT, and to ensure that the goals of the IT organization are aligned with the goals of the business. COBIT is about recognizing and safeguarding the value of information as a corporate asset by identifying and managing risks and ensuring corporate governance via effective controls. The crux of COBIT is to link IT and business goals, identify responsibilities of business and IT owners, and to monitor performance, evaluating it against metrics and maturity models.
The COBIT framework consists of 34 specific control objectives, organized into 4 domains: Plan and Organize (PO), Acquire and Implement (AI), Deliver and Support (DS), and Monitor and Evaluate (ME). The COBIT practices are business focused, process oriented, measurement driven, and control based. Best practice frameworks like COBIT are vital tools for ensuring compliance with regulations such as Sarbanes-Oxley (SOX).
COBIT and Recovery
Database recovery needs to be tackled from a best practice approach to enable your organization to do the kind of up-front planning and routine monitoring and evaluation that COBIT advocates. An organization that has adopted COBIT as a best practice framework understands the critical value of information to the business, and the need to assure its integrity and availability.
Yes, you must develop backup policies and procedures for all of your database objects that match your business availability requirements. Most DBAs have done this, at least to some degree. But what most have not done is implement regular systematic checks for the on-going viability of their backup and recovery plans to match their recovery time objectives – or even to ensure that their existing backups are valid and could be used in a recovery situation.
Recoverability is addressed by the following 19 COBIT objectives across 3 process domains:
Organizations need to better acquire and implement tools and procedures that help to verify the integrity of your backups, the system settings that could affect your ability to recover, and the processes associated with backup and recovery of your databases. Analyzing your database system, data, and backups, and determining their health and usability should be a regular practice. If not undertaken, then a system failure, logical error, malicious destruction, or catastrophic event could render your databases unusable, impact your business, and maybe even threaten the on-going viability of your business.
zJournal, Feb / Mar
© 2009 Craig S. Mullins, All rights reserved.