#iso27002/2022/EN
## 8.13 Information backup

| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
| ------------ | ------------------------------- | ---------------------- | ------------------------ | ---------------- |
| #Corrective  | #Integrity #Availability        | #Recover               | #Continuity              | #Protection      |

**Control**
Backup copies of information, software and systems should be maintained and regularly tested in accordance with the agreed topic-specific policy on backup.

**Purpose**
To enable recovery from loss of data or systems.

**Guidance**
A topic-specific policy on backup should be established to address the organization’s data retention and information security requirements.

Adequate backup facilities should be provided to ensure that all essential information and software can be recovered following an incident or failure or loss of storage media.

Plans should be developed and implemented for how the organization will back up information, software and systems, to address the topic-specific policy on backup.

When designing a backup plan, the following items should be taken into consideration:

a\) producing accurate and complete records of the backup copies and documented restoration procedures;

b\) reflecting the business requirements of the organization (e.g. the recovery point objective, see >5.30>), the security requirements of the information involved and the criticality of the information to the continued operation of the organization in the extent (e.g. full or differential backup) and frequency of backups;

c\) storing the backups in a safe and secure remote location, at a sufficient distance to escape any damage from a disaster at the main site;

d\) giving backup information an appropriate level of physical and environmental protection (see >Clause 7and >8.1>) consistent with the standards applied at the main site;

e\) regularly testing backup media to ensure that they can be relied on for emergency use when necessary. Testing the ability to restore backed-up data onto a test system, not by overwriting the original storage media in case the backup or restoration process fails and causes irreparable data damage or loss;

f\) protecting backups by means of encryption according to the identified risks (e.g. in situations where confidentiality is of importance);

g\) taking care to ensure that inadvertent data loss is detected before backup is taken.

Operational procedures should monitor the execution of backups and address failures of scheduled backups to ensure completeness of backups according to the topic-specific policy on backups.

Backup measures for individual systems and services should be regularly tested to ensure that they meet the objectives of incident response and business continuity plans (see 5.30). This should be combined with a test of the restoration procedures and checked against the restoration time required by the business continuity plan. In the case of critical systems and services, backup measures should cover all systems information, applications and data necessary to recover the complete system in the event of a disaster.

When the organization uses a cloud service, backup copies of the organization’s information, applications and systems in the cloud service environment should be taken. The organization should determine if and how requirements for backup are fulfilled when using the information backup service provided as part of the cloud service.

The retention period for essential business information should be determined, taking into account any requirement for retention of archive copies. The organization should consider the deletion of information (see 8.10) in storage media used for backup once the information’s retention period expires and should take into consideration legislation and regulations.

**Other information**
For further information on storage security including retention consideration, see ISO/IEC 27040.