Keeping old MIS servers after moving to new systems - how long?

[localzuk]

I have a discussion going on with our DPO about how long we need to maintain our old SIMS servers now we've migrated over to Bromcom.

 

As our schools are primaries/middle schools, and aren't the final school for any child, the student record side of things goes up with them to their next school.

 

However, certain aspects of the data held needs to be kept until their 25th birthday it seems - exclusion data, safeguarding etc...

 

This leads us to the conclusion that we potentially need to keep these VMs around until 2044 potentially (looking at the dates).

 

This, obviously, seems unreasonable.

 

How have those of you who have migrated data handled this? What about those of you who had hosted SIMS and migrated away, how have you maintained that data?

[mavhc]

Put VM onto backup, keep for 25 years, or use the export function of your MIS, that totally exists because why would anyone put data into something they can't easily get it out of, to archive into standard formats.

[TechMonkey]

We transferred everything. I had asked data be cleaned up as the MIS had been attempted to be used as an alumni system before I arrived, so we had data from pupils that had been present in 1946! In the end we transferred everything and tided up from there.

[TwistedHelixis]

We transferred everything.

Same, all SIMS data going back to xxx was transferred to new MIS for us. I still have the old SIMS server, but its not been getting any updates and i'll shut it down soon.

[mavhc]

How does that conflict with only keeping the minimum amount of data on people?

[kennysarmy]

We transferred the majority and anything left was output via the reporting module to XLS.

[TechMonkey]

How does that conflict with only keeping the minimum amount of data on people?

 

It doesn't. If the school is required by law to keep data for 25 years, that is the minimum amount of data. The school should have processes in place to remove the data it doesn't need.

[FN-GM]

It doesn't. If the school is required by law to keep data for 25 years, that is the minimum amount of data. The school should have processes in place to remove the data it doesn't need.

 

I addition it's better to hold the data on a live system. It ensures the data is removed (assuming automatically) at the correct intervals, well maintained so it is secure and accessible.

[mavhc]

It doesn't. If the school is required by law to keep data for 25 years, that is the minimum amount of data. The school should have processes in place to remove the data it doesn't need.

 

But which data out of all the data one has? If you transferred everything from old students let's hope you'd already minimised that data, no need for addresses etc I assume

[mavhc]

I addition it's better to hold the data on a live system. It ensures the data is removed (assuming automatically) at the correct intervals, well maintained so it is secure and accessible.

 

Easier to hack though, it does turn out that backup data doesn't really count for GDPR.

 

How many times has that data needed to be accessed in the past 25 years?

[FN-GM]

Easier to hack though

 

You could arguing holding onto a virtual machine with unpatached and unsupported software is easier to hack

[BKGarry]

I addition it's better to hold the data on a live system. It ensures the data is removed (assuming automatically) at the correct intervals, well maintained so it is secure and accessible.

 

SIMS do anything automatically, Good Joke there

[BKGarry]

How many times has that data needed to be accessed in the past 25 years?

 

You'd be surprised, and it is actually a legal requirement, also some SEN data needs to be held until the person turns 30.

[mavhc]

You could arguing holding onto a virtual machine with unpatached and unsupported software is easier to hack

 

The VM isn't running though. You'd just turn it on if any requests came through.

 

Does anyone have actual data on how many requests they get?

[dmj]

The VM isn't running though. You'd just turn it on if any requests came through.

It kind of needs to be on and checked for bitrot if you want to preserve the data.

I'd just do a dump of the data into a readable format and stick it in glacier, it will cost pennies.

[BKGarry]

I'd just do a dump of the data into a readable format and stick it in glacier, it will cost pennies.

 

You want to stick it in a ice formation?

 

I think the big issue is a lot of us heavily used linked documents in SIMS, which is not as easy to just dump out. Not saying it's not possible, but it's a lot of time needed to do it.

[dmj]

You want to stick it in a ice formation?

 

I think the big issue is a lot of us heavily used linked documents in SIMS, which is not as easy to just dump out. Not saying it's not possible, but it's a lot of time needed to do it.

 

I guess that's why Bromcom didn't bother.

 

 

https://aws.amazon.com/s3/storage-classes/glacier/

[mavhc]

It kind of needs to be on and checked for bitrot if you want to preserve the data.

I'd just do a dump of the data into a readable format and stick it in glacier, it will cost pennies.

 

Bitrot? That's why you have checksums, you can store backups for decades with no problem

[2ilent8cho]

We keep our old SIMS VM switched off then boot it up if we get a request. I've been booting it monthly this last year as had lots exam results requests from pupils who left 10 years ago.

[BKGarry]

We keep our old SIMS VM switched off then boot it up if we get a request. I've been booting it monthly this last year as had lots exam results requests from pupils who left 10 years ago.

 

Errr, be careful there, as you are only really meant to keep the results for Public examinations for Year of Examination + 6 Years.

 

I have the weird situation where we will be keeping our Finance System, so I am going to potentially get that moved to a new VM and shutdown the MIS server but keep it for now. But yes do be careful of what is the legal requirement for keeping certain aspects of data

[kennysarmy]

We keep our old SIMS VM switched off then boot it up if we get a request. I've been booting it monthly this last year as had lots exam results requests from pupils who left 10 years ago.

 

We output via SIMS Reports all the historic exam data, didn't take that long to process and these were then sent to the Exams team.

 

Since then we get very few requests and I've told them the VM will be removed permanently in Oct 2023 and everyone seems fine with that.

[dmj]

Bitrot? That's why you have checksums, you can store backups for decades with no problem

 

Sure, but you need a live filesystem to do that.

 

I think storing a SIMS disk image on the live filesystem, and waking it up when needed would be the way forward.

[PotNoodleTech]

Surely everything in SIMS should have been migrated to bromcom if access was required?

 

Keeping things ad hoc for 30 years won't work as inevitably things will go wrong technicians might change, passwords maybe lost or misplaced, the vm image itself might deteriorate/ get lost or the physical hardware it's on die/be recycled. It seems an awfully risky way of keeping data rather than just having it in your MIS ready for action.

[dmj]

Surely everything in SIMS should have been migrated to bromcom if access was required?

 

 

I guess it was in the fine print of the contract. I suspect Bromcom would be able to do the transfer, for extra money.

[mavhc]

Surely there should be standards for storing information that's supposed to be kept for 25 years, hahahaha.

 

All these online services should be sending you a complete and useful backup of all the data they have for your school every month, in a format that can actually be used.