A1.2 Environmental protections, data backups, and recovery infrastructure support availability
Authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure to meet its objectives.
5
artefacts
1
held by a system
3
at each review
hard
to go live
Backup / DR tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- The backup configuration showing scope, frequency and retention against the recovery point objective · Backup / DR tooling
periodic reviewEvidence produced at each review
- Evidence of protection of backup data, including encryption, access restriction and an immutable or offline copy · Backup / DR tooling
- Evidence of the recovery infrastructure, including alternative processing capability and its readiness · Cloud console / configuration management
- Evidence these are authorised, approved, maintained and monitored, including who approved the design · Document repository
governing documentDocuments that govern the control
- Evidence of environmental protections at the facilities in scope, covering fire detection and suppression, power continuity, cooling and water detection, with testing and maintenance records · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Backup / DR tooling on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Backups configured with failures reported and never investigated, so gaps in the backup set are unknown
- Backups reachable using production credentials, so a single compromise destroys both
- Environmental protections at the primary site only, with the recovery site unassessed
- Reliance on a cloud provider's environmental controls with no review of their assurance report or of the complementary controls it assumes
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA1.1 Maintains capacity to meet availability commitments · A1.3 Recovery plan procedures support system recovery from failures