Storage, Backup & Security

Last modified by Veronika Kocher on Friday, 04 Sep 2026 14:45

Storage, backup and security in artistic and research projects
PREPARE · SET UP INFRASTRUCTURE

Plan storage, backup and access so that important project materials remain available, recoverable and appropriately protected

Working storage, backup, access control and long-term preservation serve different purposes. For important project materials, define where the authoritative working copy lives, how it is backed up, who may access it and what should happen in the event of loss, damage or project closure.

Start with your most important materials and risks. Not every file needs the same level of protection. Decide according to importance, replaceability, sensitivity, file size, collaboration needs and the consequences of loss.
Storage, synchronisation, backup and preservation are not the same thing. A synchronised working environment can be very useful, but it does not automatically replace an independent, recoverable backup or a long-term preservation strategy.
STEP 1 · DEFINE STORAGE NEEDS

Classify materials by how critical, sensitive and difficult to replace they are

The storage strategy should reflect the project's actual risks, not only the amount of storage available.

Criticality: Which files, data or documentation would be especially difficult or impossible to replace if lost?
Sensitivity: Which materials contain personal, confidential, restricted or otherwise protected information?
Volume: What data volumes, file sizes or growth rates are expected?
Access: Who needs to read, edit, approve or administer the material?
Collaboration: Do internal and external project partners need shared access?
Versions: Do earlier states need to be restored or reconstructed?
Availability: How quickly would files need to be available again after loss or disruption?
Project closure: What should be preserved, handed over, deposited or deleted in the long term?
KEY DISTINCTIONS

These storage roles should be kept deliberately separate

Working copy ≠ backup.
The file currently being edited is not a backup of itself.
Synchronisation ≠ independent backup.
Deleted, damaged or encrypted files can also propagate into synchronised locations.
Backup ≠ long-term preservation.
A backup supports recovery after loss or error; long-term preservation also requires appropriate formats, documentation and responsibility.
Technical access ≠ ownership or copyright.
Being able to access a file does not automatically mean it may legally be used, shared or published.
Cloud storage ≠ automatically institutionally suitable.
The specific service, responsibility, access model, protection needs, export options and institutional requirements still matter.
Existing copy ≠ tested recovery.
A backup is practically useful only if it is clear how a needed file can actually be restored.
STEP 2 · DEFINE WORKING STORAGE & ACCESS

Set one authoritative working environment and clear access roles

01

Choose the working location

Define where the authoritative active project copy lives and which systems are intended for that purpose.

02

Assign responsibility

Decide who manages storage locations, permissions and technical handover.

03

Assign access by role

Grant only the rights required for each task and avoid unnecessarily broad permissions.

04

Plan external collaboration

Clarify how partners gain access, how access ends and how materials are handed over after the project.

05

Separate sensitive areas

Keep especially protected materials separate where different access rules are necessary.

06

Identify master and working copies

Make clear which version is authoritative and which local or temporary copies exist only for editing.

07

Review access

Check permissions when roles or partners change, at milestones and before project closure.

08

Plan handover

Document which storage locations, accounts and permissions will continue, transfer or close when the project ends.

STEP 3 · PLAN BACKUP & RECOVERY

Define not only that backups exist, but what is backed up, how often and how it is restored

01

Define backup scope

Specify which files, databases, configurations, documentation or project materials need to be backed up.

02

Choose frequency according to change

The more frequently irreplaceable material changes, the shorter the useful backup interval should be.

03

Check independence

Avoid having the working copy and the only backup depend on the same device, account or failure path.

04

Include versions where needed

Keep recoverable earlier states where accidental changes or deletions need to be reversible.

05

Know the recovery route

Document who can restore files, where backups are located and which steps are required when something goes wrong.

06

Test recovery

Use a harmless test file to confirm that a backup can actually be found and restored.

07

Update the strategy

Adjust it when data volume, tools, partners, storage locations or protection needs change.

08

Account for project closure

Keep active backup routines separate from the decision about what should be preserved, archived, deposited or deleted long term.

COMMON SCENARIOS

Different materials can create very different storage requirements

Large audio, video or image collections

Plan capacity, transfer times, working copies, master files and backup so that large volumes do not exist only on individual local devices.

Personal or confidential data

Restrict access, document responsibility and separate especially protected areas from generally accessible project files.

Collaborative project work

Define one shared working location, clear permissions and a handover process for partners and changing roles.

Code, software & technical environments

Where relevant, back up not only files but also configuration, dependencies and information needed to rebuild the working environment.

Ephemeral or difficult-to-reproduce work

If material cannot simply be recreated, define and review the backup strategy particularly early.

Project closure & handover

Make sure master files, documentation, storage locations and responsibilities do not remain tied to personal accounts or individual devices.

STEP 4 · DOCUMENT A MINIMUM STANDARD

A short storage and backup plan makes responsibilities traceable

Keep the agreed standard where the project team will actually find it — for example in the project folder, DMP or a technical README.

ElementWhat to recordWhy it matters
Authoritative working locationSystem, folder or service containing the active project copy.Prevents several unclear competing main copies.
ResponsibilityWho manages storage, permissions and technical handover.Makes responsibility clear in daily work and during incidents.
Access modelWhich roles may read, edit or administer.Reduces unnecessarily broad access.
Backup scopeWhich materials and systems are backed up.Prevents gaps between important work and actual backups.
Backup frequencyHow often backups or recoverable versions are created.Determines how much work could be lost in a failure.
RecoveryWho can restore and how the restore process works.Turns existing backups into a usable recovery strategy.
Sensitive areasWhich materials need additional access or protection measures.Connects technical storage to data protection and confidentiality.
Project closureWhat is handed over, preserved, deposited, archived or deleted.Separates active backup from long-term responsibility.
STOP & CHECK

Common warning signs in storage, backup and security

"Everything is in the cloud."
The specific service, responsibility, recovery process and access rules may still be undefined.
The only copy is on a laptop or external drive.
A single device remains a single point of failure.
Synchronisation is treated as backup.
Errors, deletions or unwanted changes can also affect synchronised copies.
No one has ever restored a file from backup.
It is unclear whether the backup is actually usable when needed.
Everyone has full access to everything.
Roles and protection needs have not been translated into an appropriate access model.
Project materials depend on personal accounts.
Access, responsibility and handover may be at risk when roles change or the project ends.
SERVICES & SUPPORT

Who is responsible for storage, backup and security questions

IT & Digitalisation / ZID Primary specialist responsibility for institutional digital systems, working storage, backup, account security and technical access controls.
Relevant system owner For the concrete storage, backup, recovery and permissions functions of the system or service being used.
Data Protection To be involved where personal or especially protected information creates additional requirements for access and processing.
Support Kunst und Forschung (SKF) Coordinates project and funder requirements and infrastructure dependencies, but is not responsible for the technical service itself.
RELATED TOPICS

Storage and backup are closely connected to these decisions

TRAINING & WORKSHOPS

Training, workshops & consultation sessions

Relevant opportunities for this topic will be shown here automatically from the central calendar.

COMING SOON
PRACTICAL RESOURCES

Info sheets, tutorials and templates

Info SheetsCOMING SOON
Short guidance on storage roles, backup, recovery, access and project handover.
TutorialsCOMING SOON
Step-by-step workflows for storage planning, access review and recovery testing.
Checklists & TemplatesCOMING SOON
Template for a storage and backup plan, access review and project handover.
Need help with technical implementation? Discuss concrete storage, backup and account questions with IT/ZID or the relevant system owner. In funded projects, SKF can help connect technical dependencies and funder requirements to the project route.
Search terms & related topics
storage · storage location · backup · data backup · recovery · restore · synchronisation · synchronization · cloud · access · access control · permissions · account security · sensitive data · personal data · confidentiality · master file · working copy · versioning · data loss · project handover · long-term preservation · archiving · repository · research data