(0) Not defined:

There is no evidence of a backup strategy or procedure. There is no evidence of offsite duplication of the data objects held by the repository.

(1) Initial:

Backups are made of the data objects held by the repository, but insufficient to facilitate roll-back to a specific version. There is no evidence of offsite backup or there is insufficient storage redundancy.

(2) Repeated/partial:

There is a procedure in place to make regular backups of the digital objects held by the repository. There may still be insufficient storage redundancy to ensure roll-back to meet policy or service level agreements.

(3) Defined:

The organisation has a strategy and procedure for automatic backup and duplication of digital objects held by the repository with sufficient storage redundancy. All backups are held at an offsite location and are available for restoration if required in accordance with policy and service level agreements.

(4) Managed:

The backup procedure is monitored and any identified issues recorded. Sufficient storage redundancy is continuously maintained as the number of digital objects held by the repository increases.

(5) Optimised:

At regular intervals the strategy, policy and procedure for data backup is reviewed and is adapted in accordance with policies and any service level agreements to meet the needs of the functions and services of the repository.

(0) Not defined:

There is no evidence of consistency checking or it is not applicable.

(1) Initial:

There are consistency checks but these are performed on a reactive ad hoc basis.

(2) Repeated/partial:

Consistency is checked on a regular basis but there is no defined procedure for doing so. Corrections are made but not reported or recorded.

(3) Defined:

All copies of digital objects held by the repository are checked for authenticity and consistency. If an inconsistency is found then this is recorded and reported to the responsible role in accordance with organisational policy.

(4) Managed:

Consistency checking is monitored. Levels of inconsistencies recorded are analysed and corrective procedures are implemented.

(5) Optimised:

At regular intervals the policy and procedures for consistency checking are reviewed and adapted if necessary and in accordance with organisational policy.

(0) Not defined:

There is no monitoring of storage media failure or deterioration or it is not applicable.

(1) Initial:

When a failure occurs or when corruption of data has been identified then corrective measures are taken.

(2) Repeated/partial:

There is monitoring of storage media deterioration through the monitoring of data integrity and corrective measures are taken when faults appear. There is no quality threshold set for the storage media. When a media storage device has, or is about to, fail then it is managed according to common practice.

(3) Defined:

Storage media is monitored, managed and maintained to a defined quality threshold. Identified faults and data corruptions are addressed in accordance with the management and maintenance plan.

(4) Managed:

The level of corruption, error and failure of storage media is monitored as are the corrective procedures of the management and maintenance plan.

(5) Optimised:

At regular intervals the monitoring of the storage media is reviewed and altered if appropriate to do so.

(0) Not defined:

There is no evidence awareness of or need to regular replacement of storage media or it is not applicable.

(1) Initial:

Some storage media is replaced depending upon its type.

(2) Repeated/partial:

There is regular replacement of storage media, but not in a predetermined and defined timeframe, only in the event of failure.

(3) Defined:

At regular intervals the storage media is replaced in accordance with the management and maintenance plan.

(4) Managed:

Management and replacement of storage media procedures are monitored and any discrepancies are recorded

(5) Optimised:

At regular intervals the policy for storage media replacement and the procedures for replacement are evaluated. Any changes to the policy and procedures are communicated to the relevant roles and stakeholders.

(0) Not defined:

Not applicable or there is no evidence or no awareness of network redundancy planning

(1) Initial:

There is only one network connection between the services provided by the repository and the internet. There is a redundancy plan in place which will be implemented.

(2) Repeated/partial:

There are more than one network connection between the services provided by the repository and the Internet. Network resilience is not regularly tested.

(3) Defined:

There are more than one network connection between the services provided by the repository and the Internet. Network resilience is regularly tested.

(4) Managed:

Network resilience and the testing thereof are monitored and any discrepancies are recorded.

(5) Optimised:

At regular intervals the monitoring of the network resilience is assessed and changes made. Any changes are recorded in the technical management and maintenance plan and are communicated to the relevant roles and stakeholders.