Information backup
Purpose
Maintain and regularly test backups of information, software and systems so they can be recovered after loss or failure.
How to meet this control
In short: Maintain and test backups per an agreed policy.
- Step 01Document a backup policy specifying scope, frequency, retention and recovery objectives per system, following a 3-2-1 approach
- Step 02Automate backups through native tooling (Azure Backup, AWS Backup, Veeam) covering databases, file stores and configuration
- Step 03Keep at least one copy offline or immutable so ransomware cannot encrypt or delete it
- Step 04Encrypt backups at rest and in transit and restrict access to the backup console with MFA
- Step 05Run scheduled restore tests onto isolated systems and record the time taken against the recovery time objective
- Step 06Monitor backup jobs and alert on failures, and manage expiry and secure deletion of old backups
Tip: Follow 3-2-1, keep one copy offline/immutable, and test restores.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Establish a backup policy reflecting data retention and security needs
- ›Provide enough backup capacity to recover essential information and software
- ›Produce accurate backup records and documented restoration procedures
- ›Store backups in a secure remote location far enough to survive a disaster at the main site
- ›Give backups the same physical and environmental protection as the primary site
- ›Regularly test restoring backups onto a test system, not over the originals
- ›Encrypt backups where confidentiality matters
- ›Test restoration against business continuity recovery times and manage backup deletion on expiry
Audit evidence to keep
- - Backup policy stating frequency, retention and recovery objectives
- - Backup job dashboard showing successful runs and failure alerts
- - Documented restore test result with date and time-to-recover
- - Configuration showing immutable or offline backup copies
- - Evidence backups are encrypted and access is MFA-protected
Common mistakes
- - Testing that backups exist but not that restore works
- - Setting recovery targets that the architecture cannot meet
- - Leaving backup access wider than production access
Owner, cadence, and proof
Assign one accountable owner for A.8.13. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.