Backup and uptime questions for a school platform

Why do backups and uptime matter when choosing a school platform?

Backups and uptime matter because a school platform holds records the school runs on every day: attendance, marks, timetables and messages to parents. If the service goes down, staff cannot reach them; if data is lost or locked by an attack, only a working backup brings it back. Both are part of evaluating a school platform before you buy.

A schools standard says availability can hurt. The UK Department for Education's cloud solution standards for schools and colleges say: “Poor or unreliable availability of a cloud solution could have a significant impact on running your school or college.”

Backups are the answer to the worst day. The Department's cyber security standards define a backup as “an additional copy of data, held in a different physical location (which could include being on the cloud), in case the original data is lost or damaged.” They list a ransomware attack, malware that “prevents access to your data or device unless a ransom payment is made”, among the risks of not meeting the standards.

These UK sources are not Malaysian law; they are used here as a checklist. In Malaysia, section 9 of the Personal Data Protection Act 2010 (Act 709), the Security Principle, says that where a data processor acts on a data user's behalf, the data user must ensure the processor “provides sufficient guarantees in respect of the technical and organizational security measures governing the processing to be carried out”. The personal data questions for the same meeting are in privacy questions for a first platform meeting.

What should a school ask about the vendor's backups?

A school should ask the vendor four things about its backups: what data it backs up, where that data is held, how long it is kept and how often backups are made. Ask too whether a backup can be restored for one school or one record type, and how long the vendor keeps a backup after a record is deleted.

The four questions come from the standard. The cloud solution standards ask schools to understand the provider's backup processes and policies, and list the questions: “what data do they backup?”, “where is it held”, “how long is the data held for?” and “how frequently are backups made?” The UK standard asks where backups are held for UK GDPR reasons; a Malaysian school asks it for its own data protection reasons. Our practical suggestion: ask too whether backups are kept apart from the vendor's main systems, so one incident cannot reach both.

Check the retention period. The UK Department for Education's cloud solution standards warn: “Cloud providers will only hold backup data for a limited period. This could be for as little as 30 days with some providers. This will depend on your service level agreement.” If a mistake is found after that window, the vendor's backup may no longer hold the old version.

How much downtime and data loss can the school accept?

The school should decide, for each kind of record, how long it could manage without it and how much recent work it could afford to re-enter, before comparing vendors. Attendance on a school morning and an old archive do not need the same answer, and the answer tells the school which backup and uptime promises to insist on.

The UK cloud solution standards give the factors. They ask schools to identify the backup provision each solution needs, “based on the data it will store”, and to consider its sensitivity, “its importance to normal operations”, “the impact if it were to be unavailable temporarily or permanently” and “how long you could be without the data before it becomes an issue”.

More frequent backups cost more. The cloud solution standards suggest “balancing cost against need, frequent backups are more expensive so consider the cost against the age of the data you recover from a backup”. Our practical suggestion: write the answers down per record type, so every vendor is measured against the same needs.

The two terms in a vendor's paperwork. Our practical suggestion: vendors often put these answers in a service level agreement (SLA) as a recovery point, how much recent data could be lost, and a recovery time, how long until the service and data are back. Ask for both figures in writing.

What does an uptime figure like 99.9% actually mean?

An uptime or availability figure is the share of time the service promises to be working, and small differences hide hours. Because a cloud platform runs 24 hours a day, 99% availability still allows about 7 hours of downtime a month, while 99.9% allows about 45 minutes. Ask which figure the vendor commits to in writing, and what happens when it is missed.

The UK Department for Education's cloud solution standards say: “Availability targets provided by cloud suppliers may appear misleading. Cloud solutions run 24 hours a day and 7 days a week. This means that less than 1% difference in cloud availability can significantly affect downtime and performance.”

The standard also says to make sure “published availability targets meet your needs” and to trial cloud solutions before committing to buy. A school platform pilot is the place to see how the service behaves in a real school week. Our practical suggestion: ask whether planned maintenance counts as downtime, and when in the school day it happens.

When the target is missed. Our practical suggestion: ask what the service level agreement gives the school when availability falls short (often a service credit), how the vendor tells the school about an outage (a status page, email or message), its availability record over the past year, and whether support is reachable at busy times such as the start of term and exam weeks.

How should restores be tested?

Restores should be tested on a schedule, with the result logged, because a backup only counts if the data comes back. Ask the vendor how often it tests restoring data, when the last test restoration was completed and how long a restoration takes, and whether its backups can be changed once made.

The cyber security standards list the same questions. In the UK Department for Education's cyber security standards, a school's digital lead asks its IT support “how often they test data that has been restored to check the backups are successful” and “how long a restoration will take and when the last test restoration was completed”. A school can put the same questions to a platform vendor.

Termly, and logged. The cyber security standards ask schools to “test and log your backups termly or if there is a significant change”, including the ability to recover and restore, and to have a policy on how often restorations take place “to evidence success”.

Backups that cannot be changed. The cyber security standards also ask schools to “make sure that backups are immutable, this means that they cannot be changed once they have been created”, which helps prevent data loss and reduces the risk of malware or ransomware being brought back when data is restored.

Should the school keep its own copy of the data?

Yes, for critical records. The vendor's backup protects the vendor's service; the school's own copy protects the school if the vendor's retention runs out, the contract ends or the service is unavailable. Ask how the school can take a full export, in what format, and how often.

The 3-2-1 rule. For critical data, the cloud solution standards point to the 3-2-1 rule, “at least 3 copies, on 2 devices and 1 offsite”. The cyber security standards ask schools to “have at least 3 backup copies of important data, on at least 2 separate devices”, with at least one copy off-site.

The cyber security standards say cloud services “will only backup your data for a limited time period”, so a school needs a backup plan of its own. The cloud solution standards add: “Third party solutions and plug-ins are available for cloud solutions that do not meet your data backup needs.” What a full export should contain is covered in school data ownership, export and deletion questions.

What should go in writing before the school signs?

Before signing, the school should have in writing the backup retention period, how often backups are made, the availability target and what happens when it is missed, how restores are requested and how long they take, and how the school gets a full copy of its data. Spoken answers in a demo are not enough.

Our practical checklist for the written answers:

• Backups: what is backed up, where, how often and for how long.
• Restores: how the school asks for one, how long it takes and when it was last tested.
• Availability: the target, how downtime is measured and when maintenance happens.
• The school's copy: how a full export is taken and in what format.
• The end: how long backups keep the school's data after a deletion or after the contract ends.

The Department's guidance on procuring educational technology says: “Ensure that clear timescales are agreed for data transfer and deletion, including how backups and archives will be handled.” Its cyber security standards add that a school's backup plan “should feed into your business continuity plan and disaster recovery plan”.

Carry the answers into the contract checklist, and ask the backup questions in the same meeting as the school platform demo questions.