8.14 Redundancy of information processing facilities
Requires information processing facilities to be implemented with redundancy sufficient to meet the availability requirements placed on them.
5
artefacts
1
held by a system
2
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Monitoring evidence showing redundant components are healthy and not silently failed · SIEM / log platform
periodic reviewEvidence produced at each review
- Evidence of failover testing, with results measured against the objective and the date of the last test · Backup / DR tooling
- Records of the residual single points of failure and their formal acceptance · Document repository
governing documentDocuments that govern the control
- Availability requirements per service, expressed as measurable objectives · Policy repository / GRC workspace
- The redundancy design showing how each requirement is met, and where single points of failure remain · Document repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your SIEM / log platform on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Redundancy present in the platform while a shared dependency, such as a single directory, database or network path, remains a single point of failure
- Failover never tested in production conditions, so the untested path fails when it is needed
- Redundant components degraded for months without notice because their health is not monitored separately
- Redundancy claimed inside one data centre or region, offering nothing against a site or region event
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet