Backup policy

Maintain and regularly test backups of information, software and systems per the backup policy.

What the ISO 27002 guidance expects the document to say: Requires backup copies of information, software and systems to be maintained and regularly tested, in line with the agreed topic specific policy on backup. Supporting SME guidance treats regular creation of backups together with tested recovery as the substance of the control, not the copy on its own.

The organization shall have a policy addressing the backup, recovery and restoration of PII and any further contractual or legal requirements for the erasure of PII held in backups; shall inform customers of the limits of the service regarding backup and, where it explicitly provides backup and restore services, give them clear information about its backup and restoration capabilities for PII; shall demonstrate compliance with any jurisdiction-specific requirements on backup frequency, testing and recovery procedures; shall ensure that restored PII is brought to a state where its integrity can be assured or where inaccuracy or incompleteness is identified and resolved, which can involve the PII principal; and shall keep a procedure for and a log of PII restoration efforts recording at least the person responsible and a description of the PII restored, meeting any jurisdiction-prescribed log content. Subcontracted storage of backup copies falls under the supplier controls.

Financial entities shall develop and document backup policies and procedures, and restoration and recovery procedures and methods, ensuring backups can be restored with minimal disruption, with backup systems physically and logically segregated from the source system.

This category asks the entity to be able to keep providing its services, or to restore them, when systems fail or are attacked. Backup management means backups that are taken, protected against the same event that takes out production, and demonstrably restorable, which is why restore testing rather than backup success rate is the evidence that counts. Disaster recovery means recovery objectives that were derived from what the service can actually tolerate, and infrastructure and procedure capable of meeting them. Crisis management is the decision-making layer above both: who declares a crisis, who can commit the organisation, how the entity communicates while under pressure. Because NIS2 is concerned with continuity of service to recipients, recovery objectives set purely from internal convenience are the usual weak point.