8.13 Information backup

Backups of information, software and systems are to be kept and tested regularly as the agreed topic-specific backup policy requires. Purpose: be able to get data and systems back after they are lost. Guidance: set a backup policy reflecting retention and security requirements, provide backup facilities sufficient to recover all essential information and software after an incident, failure or media loss, and develop and implement plans for backing up information, software and systems. A backup plan should consider: accurate, complete records of backup copies and documented restore procedures; the extent (full or differential) and frequency of backups, set by business requirements such as the recovery point objective (5.30), the security needs of the information and how critical it is to continued operation; storage in a safe remote location far enough away to escape a disaster at the main site; physical and environmental protection of backups consistent with the main site (Clause 7, 8.1); regular testing of backup media so they can be relied on, restoring to a test system rather than over the originals in case the backup or restore fails and destroys data; encrypting backups according to risk, for example where confidentiality matters; and making sure accidental data loss is noticed before the backup runs. Operational procedures monitor backup runs and deal with failed scheduled backups so backups are complete. Backup arrangements for individual systems and services are tested regularly against incident response and continuity objectives, together with the restore procedures and the recovery time the continuity plan requires; for critical systems, backups cover all system information, applications and data needed to rebuild the whole system after a disaster. For cloud services, back up the organization's own data, applications and systems held in the cloud environment and decide whether and how the provider's backup service meets requirements. Set retention periods for essential information including archive copies, and consider deleting information from backup media when retention expires (8.10), within the law. Other information: ISO/IEC 27040 covers storage security and retention.

Source: ISO/IEC 27002:2022, 8.13. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.

ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.