Backup and Restore Policy
Document Version: 1.0
Last Updated: July 19, 2025
Policy Owner: IT Security Manager
1. Purpose
This policy establishes requirements for backup and restoration of data, systems, and configurations to ensure availability and integrity of critical business information in the event of data loss, corruption, or disaster. It supports compliance with ISO/IEC 27001 control 5.34 (Information Backup).
2. Scope
This policy applies to:
- All information systems, databases, file servers, cloud environments, and end-user devices containing business-critical or sensitive information
- All employees, contractors, and third-party service providers managing or accessing backups
- All backup technologies and services used by the organization
3. Policy Statements
3.1 Backup Strategy
- All critical systems and data must be regularly backed up, including but not limited to:
- Databases and application data
- Configuration files
- Source code repositories
- Cloud-hosted workloads and SaaS data (where APIs permit)
- Backup types (full, incremental, differential) and frequencies (daily, weekly, monthly) shall be defined based on data criticality and recovery objectives.
3.2 Retention and Rotation
- Backups must be retained according to the organization's data retention schedule and legal/regulatory requirements.
- A backup rotation scheme (e.g., Grandfather-Father-Son or 3-2-1 rule) must be implemented.
- Backup media and storage locations must be rotated to mitigate risks of simultaneous data loss.
3.3 Storage and Protection
- Backups must be encrypted at rest and during transmission.
- At least one copy of the backup must be stored off-site or in a separate cloud region.
- Backup locations must be protected from unauthorized access and environmental hazards.
3.4 Backup Testing and Restoration
- Restoration tests must be performed at least quarterly to validate backup integrity and recovery procedures.
- Tests must include random sampling of different backup types and data categories.
- Restoration procedures must be documented and reviewed annually or after significant system changes.
3.5 Roles and Responsibilities
- IT operations is responsible for executing backups and monitoring backup jobs.
- Security is responsible for validating encryption, access controls, and compliance with this policy.
- Data owners must classify data to guide backup prioritization.
3.6 Monitoring and Reporting
- Backup logs must be monitored and reviewed regularly for failures and anomalies.
- Backup failures must trigger alerts and incident management procedures.
3.7 Third-Party and Cloud Backup
- Third-party backup service providers must comply with equivalent security standards.
- Cloud-native backup solutions must be evaluated for reliability, access control, and encryption capabilities.
- Backup of SaaS data (e.g., Google Workspace, Microsoft 365) must be assessed and implemented using supported APIs.
4. Compliance and Exceptions
- Non-compliance with this policy may result in disciplinary action and must be reported to the Information Security Manager.
- Exceptions must be formally documented, risk-assessed, and approved by IT Security.