OPS-06 Data Backup and Recovery - Concept
Document and communicate backup and recovery policies fixing backup scope, frequency and retention against contractual and internal RTO and RPO targets, requiring state of the art encryption of backups, restricting resto
4
artefacts
0
held by a system
0
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Backup policy stating retention per data class alongside the agreed RTO and RPO · Policy repository / GRC workspace
- Encryption standard and key handling rules applied to backup sets · Policy repository / GRC workspace
- Authorisation matrix naming who may trigger a restore · Policy repository / GRC workspace
- Mapping of customer contract terms onto the internal backup schedule · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Retention in the policy shorter than the periods promised to customers in contract
- Policy silent on where backup encryption keys are held and who controls them
- Restore authority expressed as a role that no longer exists in the organisation
- Policy scoped to databases while configuration, secrets and infrastructure state are omitted
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetOPS-05 Protection Against Malware - Implementation · OPS-07 Data Backup and Recovery - Monitoring