Control A.8.13Information backup
Backup copies of information, software and systems must be maintained and regularly tested in accordance with the agreed topic-specific policy on backup.
The clause that carries the control is regularly tested. An untested backup is a belief. Testing means restoring — into a representative environment, at a realistic volume, with the time it takes measured against the recovery objectives that A.5.30 is supposed to meet.
The scope includes software and systems, not just data. Recovering the data and rebuilding the platform by hand is a recovery, but rarely within the objective anyone committed to.
Ransomware has changed what “protected” means for backups. Copies reachable from the environment they protect are encrypted along with it, so isolation, immutability and offline or logically separated copies are now the point rather than a refinement.
The other element organisations under-specify is retention. A backup regime that keeps a fortnight cannot recover from corruption discovered in the third week.
How to put this in place
Ransomware, mistakes and failures happen, and without a usable copy you cannot recover. Your ISMS needs backups that match your recovery needs and are proven by restoring, not by assuming.
- Take recovery time and data-loss targets from your business impact work.
- Decide what is backed up, including cloud and software-as-a-service data, and the schedule and retention.
- Keep at least one copy offline or immutable, under separate credentials from production.
- Monitor backup jobs and fix failures.
- Test restores on a schedule and record the results, at least quarterly for critical systems.
Evidence an auditor usually looks for: backup schedules and job reports, restore test records, and settings for the offline or immutable copy.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists backup rules and records of restore tests among the documents auditors commonly expect for this control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.