Establish and Maintain a Data Recovery Process

The media used for backups and the restoration of backups are tested regularly to ensure that they can be relied on in an emergency.

Accurate and complete instructions are maintained for restoring backups. The policy is used to monitor the operation of backups and to prepare for backup failures.

In connection with the data systems listing, we describe for which systems we are responsible for the implementation of the backup. The organization’s own backup processes are documented and an owner is assigned to each. The documentation includes e.g.:

• which system is used for backing up data?
• how are the backups protected (encryption, physical location)?
• how long are the backups retained?

The organization should have a clear, written step-by-step procedure for carrying out data restoration efforts. There should also be a log of data restorations carried out. The log should contain:

• the person responsible
• date and time of the restoration
• a description of the restored data
• data that was restored manually

With adequate backups, all important data and programs can be restored after a disaster or media failure. To determine your backup strategy, it is important to map / decide on at least the following:

• What systems are on our responsibility to back up?
• How critical is each data asset and how often, based on this, they need to be backed up and to what extent (partial or complete copy)?
• Where are backups stored and how are they protected?
• How long will backups need to be retained?
• What system is used for doing the back up?
• How backup media is destroyed reliably