Data Storage and Operations

The Entity shall publish its data storage & retention policy following the below guidelines:

• Review the draft policy with the Entity’s Data Committee or equivalent body
• Incorporate Data Committee or equivalent body’s feedback
• Review draft policy for auditability
• Incorporate internal audit feedback
• Seek policy review and guidance from National Data Office and incorporate the provided feedback
• Publish the policy on Entity’s digital channels
• Socialize the policy within the Entity to drive adoption and change management

The Entity shall conduct periodic forecasts of the storage capacity required to support future business requirements. Capacity and growth should be estimated not only for the space the data itself holds, but also for indexes, logs, and any redundant images such as mirrors.

• Initial storage capacity estimate for the first year of operations
• Storage capacity growth projection for the following 3-5 years
• Estimation of the budget for future storage acquisitions

Guided by the Baseline Data Storage Capability Assessment (DSO.1.2.1) and Data Storage and Usage Requirements Forecasting (DSO.1.2.2), the Entity shall design a target data storage infrastructure architecture to support business requirements and technological advancements. This shall include, at a minimum:

• Engaging an infrastructure architecture team to determine a suitable target architecture for the storage of all data and records it holds, which shall be reviewed and approved by the Entity’s Data Committee during governance checkpoints, and NPC when necessary
• Ensuring that its target architecture reflects the latest flexible infrastructure capabilities (e.g., Private Cloud, Virtualization, Storage Virtualization, Infrastructure-as-a-Service, Platform-as-a-Service, Software-as-a-Service, etc.) and is in alignment with the Cloud First Policy

The Entity shall develop a data storage & operations roadmap, in alignment with the Entity’s data strategy, that will be used and monitored to implement and activate the data storage & operations initiatives across the Entity. The roadmap shall include, at a minimum:

• Key initiatives, milestones, and timelines needed to transition from the current to the target data storage infrastructure architecture
• The tools that need to be implemented to support data storage & operations such as data modeling tools, database monitoring tools, database management tools, and developer support tools
• Resource allocation outlining the budget, personnel, and technology resources required for each initiative

The Entity shall establish and implement a process for data backup and recovery including, at a minimum:

• Defining backup frequency for each information system, as specified in the Data Storage SLAs (DSO.3.1.1)
• Defining the backup scope for each information system, which shall include all critical data and database transaction logs to ensure comprehensive data recovery capability
• Storing backups on physically separate storage media from the operational data. The primary backup location shall be on a RAID-configured Storage Area Network (SAN), with additional off-site storage to ensure data integrity in case of a local disaster.
• Performing periodic validations of backup integrity by restoring data from backup files to a non-production system. This ensures that the backup is complete, and the data is recoverable in its entirety.

The Entity shall establish, implement, and rehearse a process to ensure business continuity in the event of disaster or adverse events that impact the Entity’s systems and its ability to use its data. The Entity shall also refer to Qatar’s Cloud First Policy and the ISO 22301:2021 standard while defining the Disaster Recovery & Business Continuity process. The process shall include, at a minimum:

• Prioritized list of information systems defining an order of the information systems recovery
• Assignment of roles responsible for addressing an incident response, including contact details of all stakeholders to be involved during an incident
• Details of actions to be taken to activate a response to the incident
• Details of actions to be taken to reduce the damage and mitigate the consequences of an incident on Entity's critical operations
• Details of Recovery Point Objectives (a maximum targeted period within which data might be lost without causing damage to business) for each information system covered
• Details of Recovery Time Objectives (a maximum targeted duration of time within which database can be down without causing damage to business) for each information system
• Details of recovery activities

The Entity shall activate the Data Storage & Operations Roadmap defined in DSO.1.2.4. The Entity shall, at a minimum:

• Demonstrate progress by adhering to the predefined milestones and timelines specified in the roadmap, to clearly reflect the transition stages from the current to the target data storage infrastructure
• Document deviations from the planned milestones and timelines, if any, and submit to the Data Committee for approval

The Entity shall enhance its data storage SLAs capabilities as follows:

• Automate the monitoring of SLAs by implementing a system that automatically monitor compliance with SLAs
• Generate automated notifications and actions by implementing systems that automatically trigger emails or notifications to relevant stakeholders if SLAs are breached

The Entity shall continuously monitor data storage systems to ensure optimal performance, making necessary adjustments to accommodate increasing data volumes or evolving organizational needs, and resolve any issues promptly. This shall include, at a minimum:

• Establishing reports and/ or dashboards to monitor and report on database performance on an on-going basis, covering metrics such as:
  • Capacity metrics (e.g.: amount of storage used, number of storage containers, etc.)
  • Performance metrics (e.g.: transaction frequency and quantity, query execution time, storage system uptime, etc.)
• Identifying and documenting any negative trends by running activity and performance reports against both the DBMS and the server during periods of heavy activity, and comparing these reports to previous reports to facilitate ongoing analysis of issues

The Entity shall establish and implement configuration management processes to record modification to the database configuration, structures, constraints, permissions, thresholds, etc. The process shall include, at a minimum, the following steps:

• Configuration identification (i.e.: identification and documentation of the attributes defining the database system configuration)
• Configuration change control (i.e.: implementation of changes in the defined database configuration)
• Configuration status accounting (i.e.: tracking of implemented changes in the configuration)
• Configuration audits (i.e.: ensuring that the installed database configuration is consistent with the documented configuration)

The Entity shall conduct database maintenances and updates to ensure integrity, security, and operational efficiency of its database systems. The Entity shall, at a minimum:

• Implement maintenance patches provided by the database system vendor across all environments (e.g.: from development to production) following recommendations and prioritization by DBA specialists, security experts, and management
• Ensure that its database systems and tools are updated to the latest published Vendor release. If the latest release is not applicable to the Entity, the Entity shall document the justification and submit to the Data Committee for approval
• Ensure that it complies with all licensing agreements and regulatory requirements by conducting information asset tracking covering aspects such as software license costs, annual support costs, and server lease agreements costs