Archiving

In order to preserve the original version of the data, data must not be changed by external or internal influences during the entire storage period, and must be protected against manipulation and deletion. Archiving systems which ensure the integrity of data are used for this purpose.

Archiving must not be equated with data protection (backup). In archives, data which is no longer needed in daily operations is placed. Backup involves copying data in order to restore it in the event of data loss or compromise, e.g., due to cyber-attacks.

Archive data is needed when companies plan business measures on the basis of this data, have to comply with legal requirements, or data is needed as evidence in the event of a dispute.

Archiving aims to store this data systematically and make it accessible in the long term.

What often causes confusion: Business applications, such as document management systems (DMS), often come with archiving functionality.

For this reason, the terms DMS/ECM, document storage, and archive are often used as synonyms. But these systems usually do not have the features for long-term and audit-proof storage.

In an archive, data is stored which must be kept for a certain period of time - unchangeable, audit-proof, and legally compliant. DMS/ECM systems are also used for filing, in addition to other tasks. However, this is focused on current business activities.

Archiving data does not result in direct profits or revenue for organizations. In addition, there are other challenges which add cost and effort to implementation and add to existing tasks for IT teams.

Therefore, archiving is often perceived as an obligatory burden.

Effort and cost must be kept low because IT teams face a variety of challenges when archiving data:

• Legal requirements: Each industry must meet very specific requirements. Data archiving regulations are becoming stricter and the list of requirements longer. Therefore, archiving systems must simplify the process to minimize the time required to manage compliance policies.
• Complex data storage: Data is archived from different applications (e-mail, SAP, DMS, PACS, etc.). To make archiving easier, it should be possible to archive data via a central system.
• Technological progress and the limited lifespan of storage media: In most cases, retention periods exceed the lifespan of the IT infrastructure. Often, new technologies cannot be used without costly migrations. To ensure efficient archiving, storage hardware and archiving software should be decoupled from each other.
• Growing volumes of data: The more data there is and the longer it needs to be retained, the more storage space is required. Storage space must be easily scalable without exploding costs and increasing administration overhead.
• Cyber-attacks: Enterprises are increasingly targeted by cyber-attacks. Archived data must be protected against loss, damage, theft, and compromise.
• Data integrity: Archive data is reliable if it is available in unchanged form. Therefore, data must be protected by technical measures from modification or deletion.

Archived data proves useful to companies again at a later date - for quality management, analyses, and strategic business development, for example.

What is the benefit of an archive storage system (for example, "behind" a DMS/ECM)?

• Comply with legal requirements: Every company is obliged to archive relevant business data in accordance with legal requirements. Data must be protected from undesired events which endanger the integrity and availability of the data during the entire retention period.
• Legal protection: In liability suits, companies often have to prove that their own products are not responsible for property damage or personal injury. Original documents are necessary for this. Archiving ensures that critical data is available in the future - for checks, audits, or in court. Archiving ensures that this data has not been altered, manipulated, or deleted and that it is valid as evidence and a reliable source of data.
• Data protection: A modern archiving system performs a variety of tasks to protect data integrity, e.g., automatic integrity checks, encryption, and WORM storage.
• Save costs: Companies conserve potentials of their system applications and primary storage by using a digital long-term archive. Data is stored on low-cost, high-capacity storage solutions. This frees up storage space on fast and expensive primary storage and reduces the cost of acquiring additional storage systems. License fees, maintenance costs, and effort can be reduced in this way.
• Safeguarding knowledge: One goal of archiving is to preserve knowledge and know-how in a company. All documents and information are stored centrally and are available at all times.

Audit-proof archiving is a special case of electronic archiving.

Audit-proof archiving means that data subject to retention is protected against manipulation and modification.

This relates to data which must be retained by the tax authority or other regulatory bodies within their retention period (6 to 10 years for many business records). Data archiving is critical to demonstrate compliance with required regulations during audits or inspections.

The guidelines for this are defined, for example, in the “GoBD” or GDPR. However, this also includes requirements defined by companies themselves.

Audit security according to GoBD

In Germany, the principles for the proper keeping of books, records, and documents in electronic form and for data access (GoBD) form the basis for audit security.

The guidelines for audit-proof archiving can be summarized into three main criteria:

• Data must be stored in an unchangeable, non-erasable, and tamper-proof manner.
• Data can be retrieved through a search.
• All actions in the archive are traceable by logging.

The 10 principles of audit-proof archiving

The legal regulations and compliance guidelines (e.g., GDPR, GoBD, product liability, HIPAA, SEC 17a-4, etc.) overlap and can be summarized in ten principles. They form the basis for audit-proof archiving:

• Business-relevant data must be retained in accordance with legal and operational requirements.
• Data must not be lost on the way to the archive or in the archive itself.
• Data must be archived in an unchangeable form within the retention periods.
• All actions in the archive system must be logged.
• It must be possible to find and reproduce each document unequivocally.
• Each document must be retrievable in a timely manner.
• Data may only be viewed by authorized users.
• Each document may be deleted only after its retention period.
• These principles must be ensured across technical changes and migrations without data loss or corruption.
• The archiving system must meet legal as well as operational requirements with regard to data security and data protection over the entire lifetime of the archive data.

How can audit-proof archiving be implemented in practice?

Archiving software helps companies to implement the requirements. The following functionalities are essential:

Immutability through WORM storage

To archive in an audit-proof manner, the integrity of archive data must be protected. An audit-proof archiving system treats data as "read-only" to protect it from modification or manipulation. One method of ensuring this is the WORM principle (Write-Once-Read-Many).

WORM is a data backup method in which data is written unchangeably to a storage medium. This means that the files can no longer be changed or deleted. However, they can be read as often as required. With the associated protection against change, companies create a basis for legally compliant archiving.

Logging with audit trails

In order to guarantee the confidentiality and integrity of data, every change made must be precisely logged. An audit trail comes into play here, in which all processes are documented: creation, storage, maintenance, use, and disposal of all data records.

This gives companies the opportunity to track events precisely. At the same time, the system records which user an event can be assigned to. A time stamp shows when an event took place. Users must not have access to the audit trail, because this must also be protected against manipulation and changes.

Access management

A rights concept for archive access increases data protection. Only users with the appropriate authorization are allowed to access the data intended for them. Audit-proof archive solutions simplify access requirements with role-based authorizations and multi-client capability.

A future-proof archive can react flexibly to changes in compliance guidelines and ensure the implementation of legal requirements. It is equally important that these points are also guaranteed in the event of further technological developments.

Companies can identify a future-proof archiving solution by asking the following questions:

• Are compliance, data protection, and legal requirements met?
• Is the archive solution scalable to withstand the data growth of the future?
• Is there no dependence on specific manufacturers or hardware?
• Can the archive solution be integrated into the existing IT infrastructure?
• Can all business applications used be connected to the archiving system?
• Can the storage infrastructure be easily renewed or expanded?
• Can data be migrated easily, e.g., when the storage infrastructure is changed?

What is Software-Defined Storage?

Software-Defined Storage (SDS) describes a storage architecture in which the storage software is separate from the underlying hardware. By decoupling software and hardware, storage capacities can be flexibly expanded and data management centrally controlled.

Companies gain independence from special hardware through a software layer between the business applications and the infrastructure. Due to their rigid design, increasing the capacity of proprietary storage systems is associated with high costs and complex migrations.

Seizing new opportunities with software-defined archiving

To keep costs and efforts under control, companies are forced to increase the efficiency of their IT in all areas and to optimize their infrastructure. The ability to scale storage capacity in the archive area at reasonable cost plays an important role in this.

Software-Defined Archiving makes this possible. Archiving software centralizes and automates the archiving process, thus relieving the IT department and the IT budget. In addition, opting for a software-based approach to archiving is an important strategic decision in any company to facilitate participation in technological developments.