Explainer: Backup and Recovery Rule (4-004K)

Note: Rule 4-004K was deleted, effective September 12, 2023. For more information, please access the Node article “President Randall approves revised information security policy” or visit the U's Regulations website.

The University of Utah’s Backup and Recovery Rule (4-004K) supports the Information Security Policy (4-004). The U’s IT security policy, rules, and procedures aim to protect the university’s IT resources, systems, and data, including that of students, patients, faculty, staff, guests, vendors, and others.

What does it say?

The Backup and Recovery Rule outlines the requirements for backup and recovery of the U’s information systems and data in the event of a disruption, error, or disaster. Backup requirements include, but are not limited to, defining the required level and frequency of backups, establishing an off-site storage location, implementing IT security controls for the off-site location and physical backup media, and retaining backups in accordance with regulatory and contractual requirements. Recovery requirements include testing physical backup media to ensure it is reliable, and testing and updating, as needed, recovery procedures to ensure recovery is timely and effective.

Why should I care?

If a natural disaster, system failure, ransomware, or similar disruption occurs, the university will be able to quickly restore critical data and IT systems, ensuring operational continuity and stability.

A loss of IT systems or data, even temporary, could affect instruction, patient care, research, and other university activities.

Who does it apply to?

The rule applies to all U students, faculty, staff, patients, and business partners, although the university and its IT staff are primarily responsible for compliance.

Up next in the August Node 4 newsletter — Information System Media Handling Rule (4-004L)

 

Node 4 Search