In this ultimate how to implement guide to ISO 27001 Annex A 8.13 Information Backup, you will learn directly from an ISO 27001 Lead Auditor:
Table of contents
- 1. Define RPO and RTO per Asset
- 2. Implement the 3-2-1 Backup Strategy
- 3. Enable Immutable (WORM) Storage
- 4. Encrypt Backups at Rest and in Transit
- 5. Backup SaaS and Cloud Applications
- 6. Verify Backup Integrity Automatically
- 7. Schedule and Document Full Restoration Tests
- 8. Secure the Backup Management Plane
- 9. Monitor Job Failures and Storage Capacity
- 10. Backup Configuration and Metadata
- About the author
1. Define RPO and RTO per Asset
Control Requirement: Backup policies must be defined based on business requirements.
Required Implementation Step: Consult asset owners to define the Recovery Point Objective (RPO – how much data can we lose?) and Recovery Time Objective (RTO – how long can we be down?) for every critical system. Hardcode these metrics into your backup software schedules (e.g., SQL logs every 15 minutes for low RPO).
Minimum Requirement: Differentiate between “Critical” (hourly backups) and “Archive” (weekly backups); a blanket policy is inefficient.
2. Implement the 3-2-1 Backup Strategy
Control Requirement: Ensure redundancy of data copies.
Required Implementation Step: Re-architect your backup storage to maintain three copies of data, on two different media types (e.g., Disk and Tape/Cloud), with one copy stored strictly offsite. Ensure the offsite copy is geographically separated to survive a physical site disaster.
Minimum Requirement: Storing backups on a partition of the same production server is a failure.
3. Enable Immutable (WORM) Storage
Control Requirement: Protect backup information against malware and ransomware.
Required Implementation Step: Configure “Object Lock” or Write-Once-Read-Many (WORM) settings on your backup repository (e.g., AWS S3 Object Lock or hardened Linux repositories). This prevents ransomware—and rogue administrators—from encrypting or deleting the backup chain.
Minimum Requirement: Backups must be read-only for a defined retention period.
4. Encrypt Backups at Rest and in Transit
Control Requirement: Ensure confidentiality of backed-up information.
Required Implementation Step: Enable AES-256 encryption on the backup jobs themselves. Manage the encryption keys separately from the backup server; if you lose the keys during a disaster, your backups are cryptographically useless.
Minimum Requirement: Never send unencrypted backup streams over the internet to a cloud provider.
5. Backup SaaS and Cloud Applications
Control Requirement: Protect information stored in cloud services.
Required Implementation Step: Deploy a third-party backup solution for Microsoft 365, Google Workspace, and Salesforce. Microsoft’s “Retention Policy” is not a backup; it does not protect against malicious deletion or corruption by an internal bad actor.
Minimum Requirement: The “Shared Responsibility Model” means the data is your problem, not the cloud provider’s.
6. Verify Backup Integrity Automatically
Control Requirement: Ensure backup copies are readable and recoverable.
Required Implementation Step: Configure your backup software (e.g., Veeam, Datto) to perform automated “SureBackup” or verification jobs. This spins up the VM in a sandbox and verifies the OS boots and applications respond, rather than just checking the file checksum.
Minimum Requirement: A “Green Tick” on the dashboard is insufficient; you need proof of bootability.
7. Schedule and Document Full Restoration Tests
Control Requirement: Regularly test the restoration procedures.
Required Implementation Step: Perform a manual full-system restore (bare metal recovery) of a critical server at least quarterly. Document the actual time taken and compare it against the RTO defined in Step 1. Save the logs as audit evidence.
Minimum Requirement: Restoring a single file is not a Disaster Recovery test.
8. Secure the Backup Management Plane
Control Requirement: Protect the backup infrastructure from unauthorised access.
Required Implementation Step: Isolate the backup server from the main domain. Use a separate workgroup, unique credentials, and Multi-Factor Authentication (MFA) for console access. If an attacker compromises Active Directory, they must not be able to pivot to the backup server.
Minimum Requirement: The backup admin account must not be the same as the domain admin account.
9. Monitor Job Failures and Storage Capacity
Control Requirement: Detect failures in backup execution.
Required Implementation Step: Configure alerts to ticket your service desk immediately upon job failure or “success with warnings”. Monitor storage repository capacity trends to predict when you will run out of space, preventing failed jobs due to “Disk Full” errors.
Minimum Requirement: Silence is not success; ensure “heartbeat” monitoring confirms the reporting system is working.
10. Backup Configuration and Metadata
Control Requirement: Ensure the ability to restore the environment, not just the files.
Required Implementation Step: Backup the configuration files of network switches, firewalls, and the backup server itself. Without these configurations, you may have the data but no infrastructure to run it on.
Minimum Requirement: Export firewall rules and switch configs to a secure text file regularly.
About the author
