Plan for regular backups of all the organisation’s data

Sometimes an unexpected event, such as a fire, flood, or equipment failure, can cause downtime. In order to be able to continue operations as quickly and smoothly as possible, continuity planning is carried out, i.e. planning the operations in advance for these exceptional situations.

Each continuity plan shall contain at least the following information:

• Event for which the plan has been made
• Goal for recovery time
• Responsible persons and related stakeholders and contact information
• Planned immediate actions
• Planned recovery steps

In connection with the data systems listing, we describe for which systems we are responsible for the implementation of the backup. The organization’s own backup processes are documented and an owner is assigned to each. The documentation includes e.g.:

• which system is used for backing up data?
• how are the backups protected (encryption, physical location)?
• how long are the backups retained?

With adequate backups, all important data and programs can be restored after a disaster or media failure. An important first step in a functional backup strategy is to identify who is responsible for backing up each piece of data. Determining the responsibility for backup is the responsibility of the owners of the information assets (systems, hardware).

If the backup is the responsibility of the partner, we will find out:

• how comprehensively does the partner back up the data?
• how the data can be recovered if necessary?
• how the backups are agreed in the contracts?

If the backup is our own responsibility, we will find out:

• whether the data backup process exists and is documented?
• whether the coverage and implementation cycle of the backup is at the level required by the importance of the data?

Continuity requirements for ICT services are derived from continuity plans that are created for core processes (e.g. related to the provision of organization's products and services) and the recovery time goals included in them.

Organization must identify what recovery times and recovery points different ICT services must be able to achieve, taking into account the defined recovery goals for related processes, and ensure the ability to achieve them.

The planning must take into account in particular:

• responsibilities are defined for preparing for, managing and responding to disruptions in ICT services
• in particular continuity plans related to ICT services have been created, approved and are regularly tested
• continuity plans contain information on performance requirements, recovery time requirements and recovery actions for each important ICT service, as well as recovery point requirements and restoring actions for each important ICT service

With adequate backups, all important data and programs can be restored after a disaster or media failure. To determine your backup strategy, it is important to map / decide on at least the following:

• What systems are on our responsibility to back up?
• How critical is each data asset and how often, based on this, they need to be backed up and to what extent (partial or complete copy)?
• Where are backups stored and how are they protected?
• How long will backups need to be retained?
• What system is used for doing the back up?
• How backup media is destroyed reliably