Backup and data protection is a critical part of the business. It is not necessarily the case that you can separate the question of where tape backups are located from where your DR (disaster recovery) site is located.
With organisations looking to reduce costs and to better utilise their IT assets, the development of active backup sites, through the use of other locations within the organisation, is an increasing trend.
The location of these sites is an issue of risk assessment and part of the governance rules and practices to be agreed by each organisation.
For example, tape vaulting services are often located within a two to four hour radius of major customers. There must be recognition that it takes time to locate the tapes and then physically return them to the operational site.
If there are issues with reading the data reliably from tapes, organisations need to consider how best they can recover the data within agreed service levels. One question must be - is there a supplier within a reasonable distance that can assist in data recovery?
There are different standards that can be referred to, for example, BS 25999 Business Continuity Management (including DR), and ISO 27001 Information Security Management. They are not prescriptive in terms of distance.
There is increasing recognition that backup tapes should be encrypted, especially if they are taken offsite. Keeping them in the homes of staff members is not seen as sound risk management.
When backup tapes are end-of-lifed, organisations must be confident that unapproved persons do not have access to the data that was once on the tapes.
Find more information and resources on offsite backup tape storage