ISO 27001 A.8.13: Information backup

Write a backup policy that defines what gets backed up, how often, where backups are stored, how long they are retained, and how they are tested. Tie everything back to your RTOs and RPOs.

Follow the 3-2-1 rule as your baseline: at least 3 copies of data, on 2 different types of media, with 1 copy off-site or in the cloud. For ransomware protection, extend to 3-2-1-1: add 1 immutable or air-gapped copy that an attacker who has compromised your network simply cannot touch.

Set backup schedules based on RPO requirements. Critical databases may need continuous replication or frequent transaction log backups. File servers can typically get by with daily incrementals and weekly full backups. System configurations should be backed up after every change. Email and collaboration platforms need at least daily backups.

Protect the backups themselves. Encrypt at rest and in transit. Keep backup credentials completely separate from production credentials. Use immutable storage (write-once-read-many) for critical backups. Implement backup-specific access controls that are independent of production access. Monitor backup systems for unauthorised access or modifications.

Test restoration regularly - this is where most organisations fall down. Restore individual files and databases monthly. Recover critical systems quarterly. Run a full disaster recovery exercise annually. Document every test: what was restored, how long it took, and what went wrong. Fix failures immediately.

Monitor backup health continuously. Alert on failed jobs and investigate promptly. Track completion rates and storage utilisation. Plan for growth before you run out of backup space. Report metrics to management and include backup testing in change management for any infrastructure changes.