Great American Title Company is hereinafter referred to as "the company."

1.0 Overview

A backup policy is similar to an insurance policy - it provides the last line of defense against data loss and is sometimes the only way to recover from a hardware failure, data corruption, or a security incident. A backup policy is related closely to a disaster recovery policy, but since it protects against events that are relatively likely to occur, in practice it will be used more frequently than a contingency planning document. A company's backup policy is among its most important policies.

2.0 Purpose

The purpose of this policy is to provide a consistent framework to apply to the backup process. The policy will provide specific information to ensure backups are available and useful when needed - whether to simply recover a specific file or when a larger-scale recovery effort is needed.

3.0 Scope

This policy applies to all data stored on corporate systems. The policy covers such specifics as the type of data to be backed up, frequency of backups, storage of backups, retention of backups, and restoration procedures.

4.0Policy

4.1Identification of Critical Data

The company must identify what data is most critical to its organization. This can be done through a formal data classification process or through an informal review of information assets. Regardless of the method, critical data should be identified so that it can be given the highest priority during the backup process. Refer to Data Classification Policy.

4.2 Data to be Backed Up

A backup policy must balance the importance of the data to be backed up with the burden such backups place on the users, network resources, and the backup administrator. Data to be backed up will include:

•All data determined to be critical to company operation and/or employee job function.

4.3Backup Frequency

Backup frequency is critical to successful data recovery. The company has determined that the following backup schedule will allow for sufficient data recovery in the event of an incident, while avoiding an undue burden on the users, network, and backup administrator.

Incremental: As determined by user

Full: Initially

Automatic: Initial full backup, followed by continuous upload of changes

4.4 Off-Site Rotation

Geographic separation from the backups must be maintained, to some degree, in order to protect from fire, flood, or other regional or large-scale catastrophes. Offsite storage must be balanced with the time required to recover the data, which must meet the company's uptime requirements.

4.5 Backup Storage

Storage of backups is a serious issue and one that requires careful consideration. Since backups contain critical, and often confidential, company data, precautions must be taken that are commensurate to the type of data being stored. The company has set the following guidelines for backup storage.

There are no restrictions to how and where backups can be stored when on-site. When shipped off-site, backups should be reasonably secured from theft or fire. A hardened facility (i.e., commercial backup service or safe deposit box) can be used but is not required. Online backups are allowable if the service meets the criteria specified herein.

4.6 Backup Retention

The Company has determined that data must be stored in multiple locations to effectively mitigate risk while preserving required data.

This is accomplished by the use of automatic backups. Automatic backups are initially full backups followed by continuous upload of changes. This data is transferred weekly to two (2) locations. The remote locations provide geographic separation of data storage.

4.7 Expiration of Backup Media

Certain types of backup media, such as magnetic tapes, has a limited functional lifespan. After a certain time in service the media can no longer be considered dependable. When backup media is put into service the date should be recorded on the media. The media should then be retired from service after its time in use exceeds manufacturer specifications.

4.8 Off-Site Employee Backup

The Company has employees and vetted contractors that work form off-site locations. Data backup will be accomplished using Flash Drives and Windows software. Each user will be provided 3 Flash Drives numbered for rotation purposes. The backup administrator will assure that monthly backups are created and mailed to the Company. Each month, the backup administrator will assure the data is transferred to an automatic backup devise and backup distribution accomplished according to this policy. The Flash Drive will then be erased and returned to the user for reuse.

4.9 Applicability of Other Policies

This document is part of the company's cohesive set of security policies. Other policies may apply to the topics covered in this document and as such the applicable policies should be reviewed as needed.

5.0 Enforcement

This policy will be enforced by the Manager and/or Executive Team. Violations may result in disciplinary action, which may include suspension, restriction of access, or more severe penalties up to and including termination of employment. Where illegal activities or theft of company property (physical or intellectual) are suspected, the company may report such activities to the applicable authorities.

6.0 Definitions

Backup To copy data to a second location, solely for the purpose of safe keeping of that data.

Backup Media Any storage devices that are used to maintain data for backup purposes. These are often magnetic tapes, CDs, DVDs, or hard drives.

Backup Administrator Individual designated to oversee and assure accuracy of backups.

Full Backup A backup that makes a complete copy of the target data.

Incremental Backup A backup that only backs up files that have changed in a designated time period, typically since the last backup was run.

Automatic Backup A backup that initially backs up all designated files, then only backs up files that have changed in a designated time period, typically since the last backup was run.

Restoration Also called "recovery." The process of restoring the data from its backup-up state to its normal state so that it can be used and accessed in a regular manner.

Flash Drive A Flash Drive is a small chip that can store certain amounts of memory depending on its size. They are approximately the size of a think stick of gum and plug into a computer’s USB port.

7.0 Revision History

Revision 1.0, 10/13/2012

Revision 2.0, 09/01/2014

Revision 3.0, 11/30/2016