Control A.8.14Redundancy of information processing facilities
Information processing facilities must be implemented with redundancy sufficient to meet availability requirements.
Redundancy and backup solve different problems and are routinely conflated. Backup recovers from loss; redundancy avoids the interruption in the first place, and the requirement follows from the availability objectives rather than from what the technology makes easy.
“Sufficient to meet availability requirements” is the proportionality: not everything needs redundancy, and paying for it where the objective does not require it is a cost with no assurance attached.
The part that has to be tested is failover. A redundant component that has never taken over has not been shown to work, and the most common discovery during a real failover is a dependency that was not duplicated — a licence server, a configuration store, a certificate, a name resolution path.
Redundancy also has a correlation limit. Two instances sharing a power feed, a provider region or a single control plane fail together, which makes the shared dependency the thing worth identifying.
How to put this in place
A single failed server, link or site can stop a service you have promised to keep available. Your ISMS needs redundancy where your availability requirements justify it, and proof that it works.
- List the critical services and their availability requirements.
- Map single points of failure for each: site, zone, connection, power and key components.
- Decide where redundancy is justified and build it, in cloud estates across zones or regions as needed.
- Test failover on a schedule and record what happened.
- Fix gaps found and update the design.
Evidence an auditor usually looks for: architecture showing redundancy, and failover test records.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.