Identity and access for your backup system: what to ask any vendor
DDSArk Compliance
Governance & Risk · Published · Updated
A backup console is a door to a copy of every patient record. That makes identity and access one of the most important things to check in any backup vendor, and one of the most commonly skipped.
Why does access to the backup console matter so much?
Because whoever can sign in can usually restore data, change retention settings or turn off a backup job. A shared password, an account that outlived its owner, or a former IT provider who still has a login is a risk to the records the backup was meant to protect. The bigger the organization, the more people come and go, and the more likely an account is forgotten.
What should you ask any backup vendor?
Five questions cover most of it:
- Can sign-in run through your own identity provider? Single sign-on lets people use the identity provider your organization already runs, commonly through a standard such as SAML, instead of a separate password. It puts password rules, multi-factor authentication and session control in one place.
- Are accounts created and removed automatically? SCIM is a standard for linking a product's accounts to your directory, so access follows joiners, movers and leavers without tickets. Without it, offboarding is a manual step someone has to remember.
- Is multi-factor authentication enforced or only available? Optional protection protects only the people who turn it on.
- How do roles limit access? Look for roles that separate who can view, who can restore and who can change settings, and for an owner role that no one else can lock out.
- Is activity logged? You should be able to see who restored what, and who changed which setting, and when.
What does good offboarding look like?
A written step, with a named owner, that removes the leaver's access to the backup console on the day they go, including accounts held by outside IT providers. Where automatic provisioning is not available, a scheduled account review is the backstop: list who has access, and remove anyone who should not.
Where DDSArk stands today
DDSArk does not currently offer SAML single sign-on or SCIM provisioning. If your organization's security review requires either, ask before you buy. In the meantime, treat offboarding as a manual step and review who has access on a schedule you document.
Key takeaways
- Access to a backup console is access to a copy of your patient records; treat it like access to the records themselves.
- Ask whether sign-in can run through your own identity provider, so one place controls passwords, multi-factor authentication and sessions.
- Ask whether accounts are created and removed automatically from your directory, because manual offboarding is where orphaned accounts come from.
- Ask how roles limit access, whether multi-factor authentication is enforced or optional, and whether restores and settings changes are logged.
- DDSArk does not currently offer SAML single sign-on or SCIM provisioning; review accounts on a schedule and remove leavers promptly.
Frequently asked questions
What is single sign-on for a backup system?
It lets people sign in to the backup console through the identity provider your organization already runs, instead of keeping a separate password. That puts password rules, multi-factor authentication and session control in one place.
What does automatic provisioning add?
It ties accounts to your directory: when someone joins, changes role or leaves, their access follows without a ticket. Without it, offboarding depends on someone remembering to remove each account by hand.
Does DDSArk support SAML single sign-on or SCIM?
Not currently. If your security review requires either, ask us before you buy rather than assuming, and plan manual account reviews in the meantime.
How often should backup-console accounts be reviewed?
On a fixed schedule that you set and document, and every time someone with access leaves the practice or the IT provider. The right interval depends on your size and risk; the habit matters more than the number.
Protect every location.
See how DDSArk recovers your fleet in minutes.