8.14 Redundancy of information processing facilities
Information processing facilities are to be built with enough redundancy to satisfy availability requirements. Purpose: keep processing facilities operating without interruption. Guidance: identify availability requirements for business services and information systems and design and build a systems architecture with redundancy that meets them. Redundancy can mean duplicating facilities partly or completely, from spare components to two of everything. Plan and implement procedures for bringing redundant components and facilities into use, stating whether they are always active or activated automatically or manually in an emergency; redundant elements must be secured as strongly as the primary ones. Mechanisms should alert the organization to failures, allow the planned procedure to run and keep services available while facilities are repaired or replaced. Consider contracting several providers for network and critical processing services, internet access among them; redundant networks; mirrored systems in two data centres in different locations; physically redundant power supplies or sources; multiple parallel software instances with automatic load balancing within or across data centres; and duplicated components within systems (processors, disks, memory) or networks (firewalls, routers, switches). Where it applies, and ideally on live systems, test that failover between components works as intended. Other information: redundancy is closely linked to ICT readiness for continuity (5.30), especially where recovery times are short; copying data to duplicates can introduce integrity errors and weakly secured duplicates can compromise confidentiality, so both must be designed for; redundancy does not usually cure faults within an application; public cloud allows multiple live copies in several places, failing over and balancing load automatically, discussed in ISO/IEC TS 23167.
Source: ISO/IEC 27002:2022, 8.14. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Monitoring and alerting configuration for component failures · SIEM / log platform
periodic reviewEvidence produced at each review
- Failover test records, preferably from production, showing failover worked as intended · Backup / DR tooling
- Evidence that redundant components carry the same security controls as primary ones · Document repository
governing documentDocuments that govern the control
- Documented availability requirements for business services and systems · Document repository
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances · Policy repository / GRC workspace
- Procedures for activating redundant components, stating whether activation is automatic or manual · Policy repository / GRC workspace
First move
Common gaps auditors find
- Redundant components exist but failover has never been tested
- Both internet links run through the same physical route or provider
- The secondary site has weaker security controls than the primary
- Single points of failure remain in supporting components such as DNS or identity services
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet