Tape-Vault Backup Encryption

Data Management and Security (Hardware) Hardware Tape-Vault Backup Encryption

This document provides technical details on the various backup and encryption processes within the Flex system, including both tape and Flexvault methods.

1. Introduction to Backups

The Flex system employs several backup strategies to ensure data integrity and disaster recovery capabilities. These strategies include traditional tape backups and the electronic Flexvault process.

2. Types of Backups

2.1. Full System Saves

  • Purpose: Comprehensive backup of the entire system, essential for a full system restore.
  • Frequency: Performed quarterly.
  • Media: Utilizes a 5-tape rotation.
  • Disaster Recovery (DR) Integration:
    • Credit Unions (CUs) retain the most current tape.
    • The next oldest tape is sent to CMC.
  • Encryption:
    • Data on these tapes is NOT ENCRYPTED by default.
    • Note: Starting with V6R1M0, IBM software encryption can be purchased for tape backups.

2.2. XSD Backups

  • Purpose: Backup for XSD units, primarily for DOCMAN data.
  • Devices:
    • Older IBM XSD units can use external tape drives, but external Hard Disk Drives (HDDs) are more successful.
    • All XSD models support external HDDs.
    • Older IBM units use a USB port for HDD connection.
    • Newer QNAP XSDs support both USB and eSATA ports.
  • Frequency: Performed monthly.
  • Procedure: Run using DOCMAN option 14.
  • Media: Uses a 2-tape/HDD rotation.
  • Timing: Can be run during the day.
  • Encryption:
    • Data on these tapes/HDDs is NOT ENCRYPTED by default.
    • Note: Starting with V6R1M0, IBM software encryption can be purchased for tape backups.

2.3. Disaster Recovery (DR) Backups

  • Purpose: Weekly backup for disaster recovery purposes.
  • Included Data (Standard):
    • CMCFLEX
    • CMCQUERY
    • CMCHIST
    • User profiles
    • Device descriptions
  • Additional Data (If CU does not have Flexvault):
    • QS36F
    • CMCDAILY
    • CMCIFS (Option 9 on GO CONFIG menu)
  • Current Status: All CUs are currently utilizing Flexvault for DR.
  • Retention (Flexvault): Data is retained on Flexvault for 60 days.

2.4. Docman Backups

  • Purpose: Backup of Docman data.
  • Daily Backup (EOD – End of Day):
    • Data: MTD (Month-To-Date) data.
    • Method: Backed up daily during EOD using Flexvault (FV) or tape.
    • Retention (Flexvault): Data is retained on Flexvault for 90 days.
  • Monthly Backup (EOM – End of Month):
    • Data: MTD data.
    • Method: Backed up monthly during EOM using FV or tape.
    • Retention (Flexvault): Data is retained on Flexvault for 13 months.
  • Full IFS Backup:
    • Frequency: Run monthly.
    • Procedure: Use option 14 on the DOCMAN menu.
    • Media: Uses a 3-tape rotation (assuming quarterly full system saves are performed).
  • Timing: Can be run during the day.
  • Encryption:
    • Note: Starting with V6R1M0, IBM software encryption can be purchased for tape backups.

2.5. EOD (End of Day) Backups

  • Tape Backup:
    • Included Data:
      • QS36F
      • MTD Docman
      • CMCD* (based on number of days defined in option 15 on CONFIG menu)
    • Media: Uses a 2-week tape rotation.
    • Encryption: Starting with V6R1M0, IBM software encryption can be purchased for tape backups.
  • Flexvault Backup:
    • Included Data:
      • QS36F
      • CMCDAILY
      • CMCIFS (Option 9 on GO CONFIG menu)
      • MTD Docman
      • MTD Credit Bureau
      • MTD Photo ID
    • Retention: Data is retained on Flexvault for 90 days.

2.6. EOM (End of Month) Backups

  • Tape Backup:
    • Included Data:
      • QS36F
      • CMCFLEX
      • CMCHIST
      • CMCQUERY
      • CMCIFS (Option 9 on CONFIG menu)
      • CMCD* (based on number of days defined in option 15 on CONFIG menu)
      • MTD Docman
    • Media: Uses a 24-month tape rotation.
    • Encryption: Starting with V6R1M0, IBM software encryption can be purchased for tape backups.
  • Flexvault Backup:
    • Included Data:
      • QS36F
      • CMCDAILY
      • CMCIFS (Option 9 on GO CONFIG menu)
      • MTD Docman
      • MTD Credit Bureau
      • MTD Photo ID
    • Retention: Data is retained on Flexvault for 13 months.
    • Media Copies: 2 media copies are created each month:
      • 1 copy stored on-site at CMC for 24 months.
      • 1 copy stored at the Granite Vault, which can be sent back to the CU after 24 months.

2.7. EOY (End of Year) Backups

  • Tape Backup:
    • Included Data:
      • QS36F
      • CMCFLEX
      • CMCHIST
      • CMCQUERY
      • CMCIFS (Option 9 on CONFIG menu)
      • CMCD* (based on number of days defined in option 15 on CONFIG menu)
      • YTD (Year-To-Date) Docman
    • Retention: This tape is kept indefinitely.
    • Encryption: Starting with V6R1M0, IBM software encryption can be purchased for tape backups.
  • Flexvault Backup:
    • Included Data:
      • QS36F
      • CMCDAILY
      • CMCIFS (Opt 9 on GO CONFIG)
      • MTD Docman
      • MTD Credit Bureau
      • MTD Photo ID
    • Retention: Data is retained on Flexvault for 13 months.
    • Media Copies: 2 media copies are created each month:
      • 1 copy stored on-site at CMC for 24 months.
      • 1 copy stored at the Granite Vault, which can be sent back to the CU after 24 months.

2.8. GL EOM (General Ledger End of Month) Backups

  • Purpose: Backup of YTD GL data.
  • Frequency: Backed up monthly.
  • Retention (Tape): Yearly tape is retained forever.
  • Encryption (Tape): Starting with V6R1M0, IBM software encryption can be purchased for tape backups.
  • Flexvault Retention: Data is retained on Flexvault for 13 months.
  • Flexvault Media Copies: 2 media copies are created each month:
    • 1 copy stored on-site at CMC for 24 months.
    • 1 copy stored at the Granite Vault, which can be sent back to the CU after 24 months.

3. Flexvault Encryption

  • Process: Flexvault is the electronic transmission process for sending credit union data to CMC for storage.
  • Encryption Algorithm: All data transmitted via Flexvault is encapsulated with 3DES (168 BIT) encryption algorithms from start to endpoint.
  • In-Transit Encryption: Any data sent using the Flexvault process will have all files encrypted while in transit.