Content library
TISAX: Information security
5.2.9: Backup and recovery management

How to fill the requirement

TISAX: Information security

5.2.9: Backup and recovery management

Task name
Priority
Status
Theme
Policy
Other requirements
Documenting and delegating ownership of own backup processes
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Backups
18
requirements

Task is fulfilling also these other security requirements

I24: Varmuuskopiointi
Katakri
12.3.1: Information backup
ISO27 Full
12.3: Backup
ISO27 Full
PR.IP-4: Backups
NIST
TEK-20: Varmuuskopiointi
Julkri
1. Task description

In connection with the data systems listing, we describe for which systems we are responsible for the implementation of the backup. The organization’s own backup processes are documented and an owner is assigned to each. The documentation includes e.g.:

  • which system is used for backing up data?
  • how are the backups protected (encryption, physical location)?
  • how long are the backups retained?
Regular testing, evaluation, and recovery instructions for backups
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Backups
22
requirements

Task is fulfilling also these other security requirements

12.3: Backup
ISO27 Full
12.3.1: Information backup
ISO27 Full
12.1.1: Documented operating procedures
ISO27 Full
PR.IP-4: Backups
NIST
TEK-20: Varmuuskopiointi
Julkri
1. Task description

The media used for backups and the restoration of backups are tested regularly to ensure that they can be relied on in an emergency.

Accurate and complete instructions are maintained for restoring backups. The policy is used to monitor the operation of backups and to prepare for backup failures.

Encryption of backup data
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Encryption
14
requirements

Task is fulfilling also these other security requirements

12.3.1: Information backup
ISO27 Full
10.1.1: Policy on the use of cryptographic controls
ISO27 Full
12.3: Backup
ISO27 Full
TEK-20: Varmuuskopiointi
Julkri
8.13: Information backup
ISO27k1 Full
1. Task description

When the confidentiality of backups is important, backups are protected by encryption. The need to encrypt backups may become highlighted when backups are stored in a physical location where security policies are unknown.

Identifying and testing the continuity capabilities required from ICT services
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Continuity management
8
requirements

Task is fulfilling also these other security requirements

5.30: ICT readiness for business continuity
ISO27k1 Full
6.2a: Jatkuvuuden hallinta
Tietoturvasuunnitelma
Article 11: Response and recovery
DORA
Article 12: Backup policies and procedures, restoration and recovery procedures and methods
DORA
5.2.8: IT service continuity planning
TISAX
1. Task description

Continuity requirements for ICT services are derived from continuity plans that are created for core processes (e.g. related to the provision of organization's products and services) and the recovery time goals included in them.

Organization must identify what recovery times and recovery points different ICT services must be able to achieve, taking into account the defined recovery goals for related processes, and ensure the ability to achieve them.

The planning must take into account in particular:

  • responsibilities are defined for preparing for, managing and responding to disruptions in ICT services
  • in particular continuity plans related to ICT services have been created, approved and are regularly tested
  • continuity plans contain information on performance requirements, recovery time requirements and recovery actions for each important ICT service, as well as recovery point requirements and restoring actions for each important ICT service
Determining responsibilities for backing up important information assets
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Backups
16
requirements

Task is fulfilling also these other security requirements

I24: Varmuuskopiointi
Katakri
12.3.1: Information backup
ISO27 Full
12.3: Backup
ISO27 Full
PR.IP-4: Backups
NIST
TEK-20: Varmuuskopiointi
Julkri
1. Task description

With adequate backups, all important data and programs can be restored after a disaster or media failure. An important first step in a functional backup strategy is to identify who is responsible for backing up each piece of data. Determining the responsibility for backup is the responsibility of the owners of the information assets (systems, hardware).

If the backup is the responsibility of the partner, we will find out:

  • how comprehensively does the partner back up the data?
  • how the data can be recovered if necessary?
  • how the backups are agreed in the contracts?

If the backup is our own responsibility, we will find out:

  • whether the data backup process exists and is documented?
  • whether the coverage and implementation cycle of the backup is at the level required by the importance of the data?
Defining a backup strategy
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Backups
11
requirements

Task is fulfilling also these other security requirements

12.3.1: Information backup
ISO27 Full
12.3: Backup
ISO27 Full
TEK-20: Varmuuskopiointi
Julkri
8.13: Information backup
ISO27k1 Full
A1.2: Recovery of infrastructure according to objectives
SOC 2
1. Task description

With adequate backups, all important data and programs can be restored after a disaster or media failure. To determine your backup strategy, it is important to map / decide on at least the following:

  • What systems are on our responsibility to back up?
  • How critical is each data asset and how often, based on this, they need to be backed up and to what extent (partial or complete copy)?
  • Where are backups stored and how are they protected?
  • How long will backups need to be retained?
  • What system is used for doing the back up?
  • How backup media is destroyed reliably
No items found.