When designing an archiving service a key consideration is the level of access available to archived assets. Whilst there is no single solution that meets all needs I’ll focus on the best practice we have used, which is centralized records management organization that is the sole group to have access to the data (other than our Legal department).
There are multiple reasons why this model has been successful. These include:
- Sustainability of the archive
- Simplified access management
- Security management
First Things First
Always keep in mind the difference between an archive and a library. In a library information is current and relevant to a broad section of a community and the need to access the information is common. There may be restrictions on certain information for security purposes but the focus in on accessibility.
Once information transitions to an archive there is an assumption that the data is no longer current and needs to be retained only for historic purposes. The two models should be mutually exclusive, and if a Product Owner or Application Owner asks to archive data but says they need to maintain routine access to the data this should be a big red flag. This isn’t a candidate for archiving, it is a zombie-app and should be treated as such with the data either moved to the current production application or to a reporting repository.
Ownership vs. Stewardship
I discussed the difference between ownership and responsibility before in the context of what gets archived but for the purposes of this article the Product Owner remains the owner of the application and its data once it is archived whereas the stewardship is transferred to a records management function. The steward of the data controls access to the archived asset and is responsible for ensuring .
Sustainability of the Archive
Usually when an application’s data is archived there are many business and IT people who have intimate knowledge of the application and its data. After five years there may still be a handful of those people left who have long memories and could still remember how to query the data. But after 10 years? What if the data retention period is multiple decades?
Realistically there will come a time when there are no business or IT people available who remember enough about an application to access it, particularly once the front-end application is retired and only data structures and custom reports remain. As such as part of the archive process it is important to ensure that the methods of data access are clearly documented and all available documentation and queries are stored and cataloged.
Transitioning the access to a dedicated records management organization that specializes in accessing archived applications ensures that the ability to retrieve data is optimized and no longer relies on one or two long term employees and their excellent memories.
Additionally once data is archived the knowledge of which application held specific data will quickly be forgotten. Audit, legal and compliance questions don’t come in the form of “we need to see the following batch records from application X”, rather they will be “we need to see the batch records for product Y in 2017”. It is unrealistic to rely on business groups to track the applications that have been archived over time and therefore this has to be transitioned to a central records management service.
Simplified Access Management
For a production application the ability to grant access is either centralized to a team under the Product Owner or is delegated to line managers, and these people or groups are also responsible for periodic reviews and approvals for continued access. These groups have a sustainment process in place so as there is turnover the authority to grant access is sustained.
Once the asset is placed into the archive the data will be secured according to the mechanisms designed for the archive and it is unrealistic to maintain an automated process for permitting business groups or line managers to govern the access levels.
Conclusion
If you are designing your archive to act also as a data warehouse then you will have to have a comprehensive and complex data access protocol.
However if your archive is limited to dormant data then a centralized data management service is an efficient and cost-effective model.
