Requirement
Cybersecurity requirements for backup and recovery management must be defined, documented and approved.
Control Implementation Guidelines
- Develop and document cybersecurity policy for backup management in the organization, including the following:
- Scope and coverage of critical information and technology systems backups
- Fast recovery of data and systems after exposure to cybersecurity incidents
- Periodic inspection of backup recovery effectiveness
- Time limit for backups
- Appropriate and advanced technologies for backups must be defined
- Support the organization's policy by the Executive Management. This must be done through the approval of the organization head or his/her deputy
Relevant Cybersecurity Tools
- Backup and Recovery Management Policy Template
Expected Deliverables
- Cybersecurity policy that covers the requirements of Backup and Recovery Management in the organization (e.g., electronic copy or official hard copy)
- Formal approval by the head of the organization or his/her deputy on the policy (e.g., via the organization's official e-mail, paper or electronic signature)
