Backup Assurance Dashboard
Reports job success, coverage gaps, restore-test pass rate and recovery-time achievement.
Available soon
- Format
- Excel
- Size
- 116 KB
- Length
- 12 sheets
- Version
- 1.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | What this dashboard is. The report the resilience coordinator keeps and sends to [[executive management]] each quarter and to [[the approver]] each year (BR-21). It holds copies of the key fields of the Backup Coverage & Retention Matrix, Restore Test Workbook, Immutable & Offline Backup Protection Checklist and Backup Failure & Restore Findings Tracker, and works out every measure from them. |
| 2 | On the Dashboard sheet, enter the As-at date (the quarter's last day), the quarter's name and the first and last day of the month whose backup jobs you report. |
| 3 | On the Data Sets sheet, copy each data set from the Backup Coverage & Retention Matrix. Below the data sets, list the critical services they serve, with each service's recovery time objective (RTO) and recovery point objective (RPO) from P22, and its cyber recovery time from P22 check MX-05. |
| 4 | On the Tests sheet, add one row per restore test, held or planned. Never enter a tabletop or a drill: it is not a restore test (BR-13). |
| 5 | On the Jobs sheet, log each failed backup job. Enter the jobs scheduled in the month for each data set on the Data Sets sheet. |
| 6 | On the Findings and Controls sheet, copy each finding from the Backup Failure & Restore Findings Tracker, and record the result of each protection control from the Immutable & Offline Backup Protection Checklist. |
| 7 | Read the Dashboard, and write the commentary beside each measure: what changed since last quarter and what you ask management to decide. Complete the quarterly page and, once a year, the yearly page. Keep each quarter's copy of the workbook, with the test records it reports, for [[3]] years or longer where law or a contract asks (BR-17). |
| 8 | To start your own dashboard, delete the contents of the first column and of every yellow cell on the data sheets, and the commentary and report text on the Dashboard. The formulas stay. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Limitations: This document helps you set up backups, protect them and prove that they restore. It is not legal advice, and following it is not a statement that you comply with NIS2, DORA, the GDPR or any standard. Which backup and testing duties apply to you depends on your sector and your national law: confirm them with counsel or your supervisor.
Why both times. Backup success is not recovery success. A backup job that finished says only that the job wrote something. It says nothing about whether the data restores, whether it restores within the time the service can wait, or whether the copy is one an attacker holding your administrator credentials could not have reached and deleted first. Only a restore shows that the copy is complete, that it opens, that the keys to it still exist, and how long recovery takes. Attackers look for the backups first, so protecting the copies and proving the restore are one piece of work. A restore in normal conditions shows the restore time. It does not show the cyber recovery time, which P22 works out with the foundations rebuilt first (BR-15). Each service here shows both.
What this dashboard is not is set out at the foot of the Dashboard sheet. It does not say that any data set, control or requirement of a law or standard is met.
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service, an important entity under NIS2 in its Member State; not a financial entity, so DORA's reporting duties do not apply. After INC-2026-014, its Head of Risk coordinated the backup baseline, and the Head of IT owns the backups. The coverage matrix was first filled on 30 Sep 2026. The dashboard is as at 30 Sep 2026.
Adapting this template
Small organisation: the eight measures are the minimum. Where one person runs the backups and also checks the restore, have someone outside IT check it (BR-14).
Periods: the Restore Testing Methodology sets them (BR-11, BR-13, BR-18). Where you change one there, change it in the settings at the foot of the Dashboard; every date follows.
Financial entity under DORA: the counts can support the oversight the management body exercises. They are not that oversight on their own.
More than one month of jobs: change the first and last day of the period. The measure names the month of the last day.
This workbook is your own record. Keep it with the test records it reports.
Dashboard
Backup assurance: quarterly dashboard
For [[executive management]] each quarter and [[the approver]] each year (BR-21). Yellow cells are yours; everything else calculates from the Data Sets, Tests, Jobs and Findings and Controls sheets. Every figure is a count with names, and every status is in words; the colour only repeats it.
Report settings
| Setting | Value | Note | ||
|---|---|---|---|---|
| As-at date (the quarter's last day) | 30 Sep 2026 | Every status, date and measure is worked out at this date. | ||
| Quarter reported | Q3 2026 | Your words. | ||
| Backup jobs reported: first day | 1 Sep 2026 | One calendar month of jobs, normally the last month of the quarter. | ||
| Backup jobs reported: last day | 30 Sep 2026 | The measure names the month of this day. | ||
Headline measures (BR-21: counts with names, never a score or a share)
| Measure | Result at the As-at date | Target | Named | What it means | The decision it supports | Coordinator's commentary |
|---|---|---|---|---|---|---|
| BAM-01 Backed up as often as the recovery point | 3 of 5 | All | Not met: DS-02 Stock and dispatch records, DS-05 Card payment records | How many critical data sets are backed up at least as often as the recovery point of the service that needs them (BR-02). A data set with no service recovery point, such as the foundations, is left out of the count. | Which backup intervals to shorten, and which suppliers to ask to change theirs. | EXAMPLE: the stock and dispatch records and card payment records miss it. The stock and dispatch records back up every 24 hours against a recovery point of 4 hours (BF-02). The card payment records have no backup of our own (BF-06). |
| BAM-02 Copies rule met | 4 of 6 | All | Not met: DS-05 Card payment records, DS-06 Directory, network configuration, backup catalogue and build images | How many critical data sets have the copies the 3-2-1-1-0 rule asks for and no copy whose restore has not been checked (BR-03, BR-04). | Where to add a copy, an offsite copy or an immutable or offline copy, and which restore checks to bring forward. | EXAMPLE: the card payment records have one copy, held by the provider (BF-06). The backups of the directory, network configuration and backup catalogue have never been restored and checked (BF-05). |
| BAM-03 Protection controls met | 9 of 15 met; 3 not met; 3 not checked | All met; none unchecked | Not met: BP-01, BP-09, BP-15. Not checked: BP-03, BP-04, BP-10 | Protection checklist controls met. A control nobody has checked counts as not checked, because an unchecked protection is an unproven one. | Which controls to fix first, and which supplier checks to chase. | EXAMPLE: BP-03, BP-04, BP-10 are the backup provider's controls. They stay not checked until its assessment on 3 Nov 2026 (BF-07). BP-01, BP-09, BP-15 are not met (BF-03, BF-04, BF-06). |
| BAM-04 Failed backup jobs | 3 of 120 jobs failed in September; 3 fixed within their time; 0 open; 3 took a data set outside its recovery point | None open past their time | FJ-2026-09-01 on DS-02: 37.7 h without a good copy; FJ-2026-09-02 on DS-04: 42.1 h without a good copy; FJ-2026-09-03 on DS-01: 35.7 h without a good copy | Jobs that failed in the period, out of those scheduled. A job that was fixed still counts as a failure: the count shows how often a good copy was missing (BR-11). | Whether a data set needs a shorter interval, a supplier needs to change, or a repeat failure needs a finding. | EXAMPLE: each failure was fixed within 24 hours, and each data owner was told the day it was found (BR-11). Each left its data set without a good copy for longer than the recovery point of its service. |
| BAM-05 Restore checked in time | 4 of 5 | All | Not restored and checked in time: DS-06 Directory, network configuration, backup catalogue and build images | Critical data sets with a copy of our own that were restored and checked within the period for their class (BR-04, BR-13). Data held only by a provider is left out. | Which restore checks to bring forward before their due date. | EXAMPLE: the first restore of the directory backup, the network configuration and the backup catalogue is RT-2026-10 on 18 Nov 2026 (BF-05). |
| BAM-06 Restored within the recovery time | 2 of 5 | All | Not within: Online ordering, Payments, Customer contact | Critical services that came back within their recovery time objective in a test in the last 12 months. The objectives are P22's. The count comes from the tests (BR-14). | Which services need a fix and a retest, and which results the business can rely on. | EXAMPLE: the figure P03 reports as BM-06. Online ordering took 96 hours against 24 (BF-01). |
| BAM-07 Data lost within the recovery point in tests | 2 of 3 | All | 1 beyond the recovery point | Timed tests in the last 12 months where the data lost was within the recovery point, out of the tests that measured it. | Whether a backup interval is too long for the service that needs the data. | EXAMPLE: the warehouse dispatch restore of 27 Aug 2026 lost 24 hours of data against a recovery point of 4 (BF-02). |
| BAM-08 Findings open and past due | 8 open; 2 High; 0 past due | No High finding past due | High: BF-01, BF-02 | Findings not yet closed, with the High findings and those past their due date named (BR-18). | For a finding past due: escalate it, fund the fix, or agree a new date with the risk owner told (P05 RM-10). | EXAMPLE: all 8 came from the baseline of 30 Sep 2026. The two High findings follow P22's objective gaps OG-01 and OG-05. |
Each figure counts named data sets, controls, jobs, tests or findings. Add none of them together, and never show one as a share or a colour total (BR-21).
Replace the EXAMPLE commentary with yours each quarter: what changed since last quarter, and what you ask management to decide.
Each data set: the six coverage checks and the last restore that was checked
| Data set | Class and kind | Last restore checked | Checks not met | Next restore check due (BR-13) | Next planned restore against its due date | Failed jobs in the period |
|---|---|---|---|---|---|---|
| DS-01 Orders and customer accounts | Critical, system | 17 Sep 2026 | None | 17 Dec 2026 | Before its due date | 1 |
| DS-02 Stock and dispatch records | Critical, system | 27 Aug 2026 | BC-02 Backed up as often as the recovery point | 27 Nov 2026 | Before its due date | 1 |
| DS-03 Ledgers and payroll records | Critical, saas | 15 Jul 2026 | None | 15 Oct 2026 | Before its due date | 0 |
| DS-04 Email and office documents | Critical, saas | 10 Sep 2026 | BC-04 Retention meets the longest need | 10 Dec 2026 | Before its due date | 1 |
| DS-05 Card payment records | Critical, provider-held | The provider holds it | BC-02 Backed up as often as the recovery point; BC-03 Copies meet the rule; BC-06 Cloud and provider-held data covered | 0 | ||
| DS-06 Directory, network configuration, backup catalogue and build images | Critical, foundations | Never tested | BC-05 Restored and checked in time | 30 Dec 2026 | Before its due date | 0 |
The six checks, in order: BC-01 Listed and owned; BC-02 Backed up as often as the recovery point; BC-03 Copies meet the rule; BC-04 Retention meets the longest need; BC-05 Restored and checked in time; BC-06 Cloud and provider-held data covered. Each is worked out on the Data Sets sheet.
A data set the provider holds with no copy of ours has no restore to check. It is tested through the provider's own recovery test (BR-12).
Each critical service: restore time and cyber recovery time side by side (BR-15)
| Critical service | Recovery time objective, hours | Recovery point objective, hours | Last timed test: date and time achieved | Restore time against the objective | Cyber recovery time, hours (P22 MX-05) | Cyber recovery time against the objective |
|---|---|---|---|---|---|---|
| CS-01 Online ordering | 24 | 24 | 20 May 2026: 96 h | Missed the RTO | 108 | After the RTO |
| CS-02 Warehouse dispatch | 8 | 4 | 27 Aug 2026: 5 h | Within the RTO | 17 | After the RTO |
| CS-03 Payments | 24 | 0 | Never tested | Never tested | 0 | Within the RTO |
| CS-04 Finance and payroll | 48 | 1 | 20 Jan 2026: 3 h | Within the RTO | 12 | Within the RTO |
| CS-05 Customer contact | 24 | 24 | Never tested | Never tested | 12 | Within the RTO |
The objectives are P22's (RR-04). A restore in normal conditions is not the time after a destructive attack: the cyber recovery time rebuilds the foundations first (BR-15).
Findings by severity (BR-18)
| Severity | Open | Past due | Plan not agreed by its date | Days to fix (BR-18) |
|---|---|---|---|---|
| High | 2 | 0 | 0 | 90 |
| Medium | 6 | 0 | 0 | 180 |
| Low | 0 | 0 | 0 | 365 |
A finding that is also a P22 objective gap keeps the date P22 RR-15 sets. A finding closes only when a retest or new evidence shows that the fix works (BR-18).
Quarterly report: page for executive management (BR-21)
| For | [[executive management]] | |||||
| Meeting on | [[YYYY-MM-DD]] | |||||
| Quarter and As-at date | Q3 2026, as at 30 Sep 2026. The eight measures above are the report: send them with this page. | |||||
| Where we stand | This is the first backup assurance report. The coverage matrix was first filled on 30 Sep 2026, after INC-2026-014. Critical data sets backed up as often as their recovery point: 3 of 5. Copies rule met with no unverified copy: 4 of 6. Restored and checked in time: 4 of 5. Protection controls: 9 of 15 met; 3 not met; 3 not checked. The three not checked belong to the backup provider, which has not been assessed. Backup jobs: 3 of 120 jobs failed in September; 3 fixed within their time; 0 open; 3 took a data set outside its recovery point. Critical services restored within their recovery time objective: 2 of 5. Timed tests whose data lost was within the recovery point: 2 of 3. Online ordering took 96 hours against 24 (BF-01). Warehouse dispatch lost 24 hours of data against 4 (BF-02). Findings: 8 open; 2 High; 0 past due. | |||||
| What we ask you to decide | Note that online ordering cannot restore within 24 hours until P05 TA-01 is done (15 Dec 2026) and tested on 10 Mar 2027. Note that the backup provider's assessment on 3 Nov 2026 decides 3 of the controls (BF-07). The Chief Financial Officer decides whether to keep a copy of the card payment records (BF-06). | |||||
Yearly report: page for the approver (BR-21)
| For | [[the approver]] | |||||
| Meeting on | [[YYYY-MM-DD]] | |||||
| The year in counts | In the 12 months to the As-at date | |||||
|---|---|---|---|---|---|---|
| Restore tests held | 6 | |||||
| of which restored a backup | 5 | |||||
| of which passed every criterion | 3 | |||||
| Findings raised | 8 | |||||
| Findings closed | 0 | |||||
| Restore tests planned for the next 12 months | 10 | |||||
| The year in words | In the 12 months to 30 Sep 2026, 6 restore tests were held, 5 of which restored a backup. Two failed: online ordering on its recovery time and warehouse dispatch on its recovery point. The baseline raised 8 findings, 2 of them High, each with an owner and a due date. The foundations' backups have never been restored; the first restore is RT-2026-10 on 18 Nov 2026. | |||||
| For your approval | Approve the backup standard and the coverage matrix of 6 data sets (BA-01). Approve the year's 10 planned restore tests, 13 Oct 2026 to 10 Mar 2027 (BA-08). Note the open findings, named on the Dashboard. | |||||
Keep this report, the workbook it comes from and the test records it counts for [[3]] years, or longer where law or a contract asks (BR-17).
What this dashboard is not
It is not a score. Backup assurance is reported to executive management each quarter and to the approver each year, as counts with every gap named: no score and no share of success (P22 RR-20).
A tabletop, a drill or any other exercise is not a restore test, and is never counted here (BR-13).
A job that finished is not a backup that restores. Only a restore, checked and timed, shows that (BR-14).
It does not say that any data set, control or requirement of NIS2, DORA, the GDPR or any standard is met. It counts what ran, what is protected and what restored, and names what did not.
It does not run a restore or an incident response. Stopping and protecting backups in an incident are the incident manager's steps (P09 C3, C4).
Settings the formulas read (from the Restore Testing Methodology)
| Setting | Value | Rule |
|---|---|---|
| Copies of a critical data set, live data included | 3 | BR-03 |
| Kinds of storage | 2 | BR-03 |
| Offsite copies | 1 | BR-03 |
| Immutable or offline copies | 1 | BR-03 |
| Months between restore checks: Critical | 3 | BR-13 |
| Months between restore checks: Important | 6 | BR-13 |
| Months between restore checks: Other | 12 | BR-13 |
| Months in the year of tests (P22 RR-14) | 12 | BR-13 |
| Hours to fix a failed job: Critical | 24 | BR-11 |
| Hours to fix a failed job: Important | 72 | BR-11 |
| Hours to fix a failed job: Other | 168 | BR-11 |
| Failures in a row that are raised as a finding | 2 | BR-11 |
| Working days to agree the plan for a finding | 10 | BR-18 |
| Days to fix a High finding | 90 | BR-18 |
| Days to fix a Medium finding | 180 | BR-18 |
| Days to fix a Low finding | 365 | BR-18 |
These are the Restore Testing Methodology's values. Public holidays are yours to add to the working-day count. Records are kept for [[3]] years (BR-17).
Data Sets
One row per data set, from the Backup Coverage & Retention Matrix. Yellow columns are yours; white columns calculate at the As-at date on the Dashboard. Below the data sets, list the critical services they serve.
| Row | Data set ID | Data set | Class (BR-13) | Kind (BR-12) | Critical service it serves (ID) | Data owner | Where it is held | How it is backed up | Who runs the backup | First listed on | Copies held | Copies, live data included | Kinds of storage | Offsite copies | Immutable or offline copies | Backup interval, hours | Retention kept, days | Business need, days | Legal or contract need, days | Recovery need, days | Our own copy outside the provider's account | Provider's commitment covers the need | Jobs scheduled in the period | Service recovery point, hours (calc) | BC-01 Listed and owned (calc) | BC-02 Backed up as often as the recovery point (calc) | BC-03 Copies meet the rule (calc) | BC-04 Retention meets the longest need (calc) | Restore check period, months (calc) | Last restore checked (calc) | BC-05 Restored and checked in time (calc) | BC-06 Cloud and provider-held data covered (calc) | Copies rule met, no unverified copy (calc, BAM-02) | Checks not met (calc) | Next restore check due (calc, BR-13) | Next restore planned (calc) | Planned restore against its due date (calc) | Failed jobs in the period (calc) | Critical sets missing their recovery point, so far (working) | Critical sets failing the copies rule, so far (working) | Critical sets not restored in time, so far (working) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | DS-01 | Orders and customer accounts | Critical | System | CS-01 | Chief Operating Officer | Ordering platform database, hosted (P06 SUP-002) | Nightly backup to the backup service provider's platform, and an offline copy | Backup service provider (P06 SUP-011), with the IT Operations Manager | 30 Sep 2026 | Live data; Nightly backup; Offline copy | 3 | 3 | 2 | 1 | 24 | 35 | 30 | 35 | 30 | 24 | Met | Met | Met | Met | 3 | 17 Sep 2026 | Met | Not applicable | Yes | None | 17 Dec 2026 | 15 Oct 2026 | Before its due date | 1 | ||||||
| EXAMPLE | DS-02 | Stock and dispatch records | Critical | System | CS-02 | Head of Logistics | Warehouse management system database (P07 SYS-02) | Daily backup to cloud object storage, and an offline copy | In-house, the IT Operations Manager | 30 Sep 2026 | Live data; Daily backup; Offline copy | 3 | 3 | 2 | 1 | 24 | 35 | 14 | 35 | 30 | 4 | Met | Not met | Met | Met | 3 | 27 Aug 2026 | Met | Not applicable | Yes | BC-02 Backed up as often as the recovery point | 27 Nov 2026 | 12 Nov 2026 | Before its due date | 1 | DS-02 Stock and dispatch records | |||||
| EXAMPLE | DS-03 | Ledgers and payroll records | Critical | SaaS | CS-04 | Chief Financial Officer | ERP, hosted by the provider (P07 SYS-01, P06 SUP-004) | The provider's continuous backup, and a nightly export held offline | ERP software provider (P06 SUP-004), with the IT Operations Manager | 30 Sep 2026 | Live data; Provider's continuous backup; Nightly export | 3 | 3 | 2 | 1 | 0.25 | 90 | 90 | 35 | Yes | No | 1 | Met | Met | Met | Met | 3 | 15 Jul 2026 | Met | Met | Yes | None | 15 Oct 2026 | 13 Oct 2026 | Before its due date | 0 | DS-02 Stock and dispatch records | ||||
| EXAMPLE | DS-04 | Email and office documents | Critical | SaaS | CS-05 | Sales Director | Email and office tenant (P06 SUP-005) | Daily export of the tenant to our backup storage, and a weekly offline copy | In-house, the IT Operations Manager | 30 Sep 2026 | Live tenant; Daily export; Weekly offline copy | 3 | 3 | 2 | 1 | 24 | 30 | 30 | 35 | Yes | No | 30 | 24 | Met | Met | Met | Not met | 3 | 10 Sep 2026 | Met | Met | Yes | BC-04 Retention meets the longest need | 10 Dec 2026 | 28 Oct 2026 | Before its due date | 1 | DS-02 Stock and dispatch records | |||
| EXAMPLE | DS-05 | Card payment records | Critical | Provider-held | CS-03 | Chief Financial Officer | The payment service provider's platform (P06 SUP-003) | None of our own: the provider holds the data and the distributor holds no backup of it | Payment service provider (P06 SUP-003) | 30 Sep 2026 | Provider's live data | 1 | 1 | 0 | 0 | No | No | 0 | Met | Not met | Not met | Not applicable | 3 | Not applicable | Not met | No | BC-02 Backed up as often as the recovery point; BC-03 Copies meet the rule; BC-06 Cloud and provider-held data covered | None planned | 0 | DS-02 Stock and dispatch records, DS-05 Card payment records | DS-05 Card payment records | ||||||||||
| EXAMPLE | DS-06 | Directory, network configuration, backup catalogue and build images | Critical | Foundations | Head of IT | Sign-in directory, core network and firewalls, backup platform (P22 foundations) | Nightly backup of the directory, configuration and catalogue, and offline golden images and baselines | Managed IT service provider (P06 SUP-001) and the backup service provider (P06 SUP-011) | 30 Sep 2026 | Live configuration; Nightly backup; Offline golden images and baselines | 3 | 3 | 2 | 1 | 24 | 90 | 90 | 35 | 30 | Met | Not applicable | Met | Met | 3 | Not met | Not applicable | No | BC-05 Restored and checked in time | 30 Dec 2026 | 18 Nov 2026 | Before its due date | 0 | DS-02 Stock and dispatch records, DS-05 Card payment records | DS-05 Card payment records, DS-06 Directory, network configuration, backup catalogue and build images | DS-06 Directory, network configuration, backup catalogue and build images |
Critical services the data sets serve, with both recovery times (BR-15)
Copy each critical service and its objectives from P22 (RR-04), and its cyber recovery time from check MX-05. The restore time is the time achieved in the service's latest timed test on the Tests sheet.
| Row | Service ID | Critical service | Recovery time objective, hours | Recovery point objective, hours | Cyber recovery time, hours (P22 MX-05) | Last timed test (calc) | Time achieved, hours (calc) | Tested in the last 12 months (calc) | Restored within the RTO (calc, BAM-06) | Restore time against the RTO (calc) | Cyber recovery time against the RTO (calc) | Not within the RTO, so far (working) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | CS-01 | Online ordering | 24 | 24 | 108 | 20 May 2026 | 96 | Yes | No | Missed the RTO | After the RTO | Online ordering |
| EXAMPLE | CS-02 | Warehouse dispatch | 8 | 4 | 17 | 27 Aug 2026 | 5 | Yes | Yes | Within the RTO | After the RTO | Online ordering |
| EXAMPLE | CS-03 | Payments | 24 | 0 | 0 | No | No | Never tested | Within the RTO | Online ordering, Payments | ||
| EXAMPLE | CS-04 | Finance and payroll | 48 | 1 | 12 | 20 Jan 2026 | 3 | Yes | Yes | Within the RTO | Within the RTO | Online ordering, Payments |
| EXAMPLE | CS-05 | Customer contact | 24 | 24 | 12 | No | No | Never tested | Within the RTO | Online ordering, Payments, Customer contact |
Tests
One row per restore test, held or planned. A restore test restores data and checks the result against the pass criteria (BR-14). A tabletop, a drill or any other exercise is not a restore test: never enter one (BR-13). A test that restores no backup, such as a supplier's failover, is entered with "Restores a backup" set to No.
| Row | Test ID | Data set ID | Date | Type (BR-12) | Status | Restores a backup | What is restored | Linked to | Copy and restored data integrity checks | Restore completed | Tested by | Checked by | Confirmed usable by | Evidence recorded | Time achieved, hours | Data lost, hours | Service (calc) | RTO, hours (calc) | RPO, hours (calc) | TC-01 Restore completed (calc) | TC-02 Integrity checks passed (calc) | TC-03 Time within the RTO (calc) | TC-04 Data lost within the RPO (calc) | TC-05 Checked independently and confirmed (calc) | TC-06 Evidence recorded (calc) | Result (calc, BR-14) | Criteria not met (calc) | Time against the RTO (calc) | Data lost against the RPO (calc) | Held in the 12 months to the As-at date (calc) | Service and date (working) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | RT-01 | DS-03 | 20 Jan 2026 | TT-5 | Held | No | The ERP provider's failover between its data centres, with results shared (P06 CON-05). It restores no backup. | P22 RV-2026-01 | Not applicable | Yes | ERP software provider | Yes | 3 | 0 | CS-04 | 48 | 1 | Not a restore test | Within the RTO | Within the RPO | Yes | CS-04|46042 | |||||||||
| EXAMPLE | RT-02 | DS-01 | 20 May 2026 | TT-2 | Held | Yes | The ordering platform restored from its nightly backup into the hosting provider's spare environment | P22 RV-2026-02 | Pass | Yes | IT Operations Manager | Information Security Manager | Chief Operating Officer | Yes | 96 | 24 | CS-01 | 24 | 24 | Met | Met | Not met | Met | Met | Met | Failed | TC-03 | Missed the RTO | Within the RPO | Yes | CS-01|46162 |
| EXAMPLE | RT-03 | DS-03 | 15 Jul 2026 | TT-5 | Held | Yes | A copy of the ledgers restored by the ERP provider into a test instance, and checked for integrity (P11 MC-35) | Pass | Yes | ERP software provider | Information Security Manager | Chief Financial Officer | Yes | CS-04 | 48 | 1 | Met | Met | Not applicable | Not applicable | Met | Met | Passed | Yes | |||||||
| EXAMPLE | RT-04 | DS-02 | 27 Aug 2026 | TT-2 | Held | Yes | The warehouse management system restored from backup and checked by the warehouse team | P22 RV-2026-03 | Pass | Yes | IT Operations Manager | Information Security Manager | Head of Logistics | Yes | 5 | 24 | CS-02 | 8 | 4 | Met | Met | Met | Not met | Met | Met | Failed | TC-04 | Within the RTO | Beyond the RPO | Yes | CS-02|46261 |
| EXAMPLE | RT-05 | DS-04 | 10 Sep 2026 | TT-1 | Held | Yes | A sample of mailboxes restored from the daily export and opened (P11 MC-35) | Pass | Yes | IT Operations Manager | Information Security Manager | Sales Director | Yes | CS-05 | 24 | 24 | Met | Met | Not applicable | Not applicable | Met | Met | Passed | Yes | |||||||
| EXAMPLE | RT-06 | DS-01 | 17 Sep 2026 | TT-1 | Held | Yes | The latest of the ordering platform's monthly restore checks, with the backup provider (P10 EA-04, P11 MC-35): the database restored and checked for integrity | P10 EA-04 | Pass | Yes | IT Operations Manager | Information Security Manager | Chief Operating Officer | Yes | CS-01 | 24 | 24 | Met | Met | Not applicable | Not applicable | Met | Met | Passed | Yes | ||||||
| EXAMPLE | RT-2026-07 | DS-03 | 13 Oct 2026 | TT-5 | Planned | Yes | The ERP provider restores last month's ledgers to a test instance, and the IT Operations Manager checks them | CS-04 | 48 | 1 | Planned | ||||||||||||||||||||
| EXAMPLE | RT-2026-08 | DS-01 | 15 Oct 2026 | TT-1 | Planned | Yes | The ordering platform's monthly restore check with the backup provider (P10 EA-04) | CS-01 | 24 | 24 | Planned | ||||||||||||||||||||
| EXAMPLE | RV-2026-04 | DS-04 | 28 Oct 2026 | TT-5 | Planned | Yes | Mailboxes restored to a test tenancy, with the providers (P22 RV-2026-04) | P22 RV-2026-04 | CS-05 | 24 | 24 | Planned | |||||||||||||||||||
| EXAMPLE | RT-2026-09 | DS-02 | 12 Nov 2026 | TT-1 | Planned | Yes | The warehouse management system's database restored to a separate environment and checked | CS-02 | 8 | 4 | Planned | ||||||||||||||||||||
| EXAMPLE | RT-2026-10 | DS-06 | 18 Nov 2026 | TT-1 | Planned | Yes | The first restore of the directory backup, the network configuration and the backup catalogue, into an isolated environment | 0 | Planned | ||||||||||||||||||||||
| EXAMPLE | RT-2026-11 | DS-02 | 17 Dec 2026 | TT-1 | Planned | Yes | Retest of the recovery point after the warehouse database moves to a 4-hourly backup (BF-02) | CS-02 | 8 | 4 | Planned | ||||||||||||||||||||
| EXAMPLE | RV-2027-01 | DS-05 | 13 Jan 2027 | TT-5 | Planned | No | The payment provider's own recovery test, its results shared (P22 RV-2027-01) | P22 RV-2027-01 | CS-03 | 24 | 0 | Planned | |||||||||||||||||||
| EXAMPLE | RV-2027-02 | DS-03 | 20 Jan 2027 | TT-5 | Planned | No | The ERP provider's failover (P22 RV-2027-02) | P22 RV-2027-02 | CS-04 | 48 | 1 | Planned | |||||||||||||||||||
| EXAMPLE | RV-2027-03 | DS-06 | 17 Feb 2027 | TT-4 | Planned | Yes | Foundations rebuilt in an isolated recovery environment, then the warehouse management system restored: the first measure of the cyber recovery time (P22 RV-2027-03) | P22 RV-2027-03 | 0 | Planned | |||||||||||||||||||||
| EXAMPLE | RV-2027-04 | DS-01 | 10 Mar 2027 | TT-3 | Planned | Yes | The ordering platform recovered on the rebuilt recovery set-up, against its objectives (P22 RV-2027-04) | P22 RV-2027-04 | CS-01 | 24 | 24 | Planned |
Jobs
One row per failed backup job (BR-11). A job stopped on the incident manager's instruction under P09 C3 is not a failure: do not log it here. The jobs scheduled each month are entered per data set on the Data Sets sheet.
| Row | Failure ID | Data set ID | Job failed at | Failure found at | Cause | Last good copy before the failure | Good copy again at | Data owner told on | Status | Data set (calc) | Class (calc) | Hours from failure to a good copy (calc) | Hours allowed (calc, BR-11) | Fixed within its time (calc) | Hours without a good copy (calc) | Recovery point of its service, hours (calc) | Took the data set outside its recovery point (calc) | In the period (calc) | Failures of this data set in the period (calc) | Repeat failure: raise a finding (calc) | Failures in the period, so far (working) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | FJ-2026-09-01 | DS-02 | 8 Sep 2026 | 8 Sep 2026 | No space on the backup target | 7 Sep 2026 | 8 Sep 2026 | 8 Sep 2026 | Closed | Stock and dispatch records | Critical | 13.83 | 24 | Yes | 37.67 | 4 | Yes | Yes | 1 | No | FJ-2026-09-01 on DS-02: 37.7 h without a good copy |
| EXAMPLE | FJ-2026-09-02 | DS-04 | 16 Sep 2026 | 16 Sep 2026 | The provider limited the export | 15 Sep 2026 | 16 Sep 2026 | 16 Sep 2026 | Closed | Email and office documents | Critical | 18.25 | 24 | Yes | 42.08 | 24 | Yes | Yes | 1 | No | FJ-2026-09-01 on DS-02: 37.7 h without a good copy; FJ-2026-09-02 on DS-04: 42.1 h without a good copy |
| EXAMPLE | FJ-2026-09-03 | DS-01 | 29 Sep 2026 | 29 Sep 2026 | A network interruption between the platform and the backup service | 28 Sep 2026 | 29 Sep 2026 | 29 Sep 2026 | Closed | Orders and customer accounts | Critical | 11.5 | 24 | Yes | 35.67 | 24 | Yes | Yes | 1 | No | FJ-2026-09-01 on DS-02: 37.7 h without a good copy; FJ-2026-09-02 on DS-04: 42.1 h without a good copy; FJ-2026-09-03 on DS-01: 35.7 h without a good copy |
Findings and Controls
One row per finding, from the Backup Failure & Restore Findings Tracker (BR-18). Every failed criterion, failed check, unmet protection control and repeat job failure is a finding. The protection controls are below the findings, from the Immutable & Offline Backup Protection Checklist.
| Row | Finding ID | Severity | Finding | Raised by | The fix | Owner | Found on | Due | Linked work | Status | Plan agreed on | Closed on | Plan to be agreed by (calc, BR-18) | Latest fix date for its severity (calc) | Open (calc) | Past its due date (calc) | Plan not agreed by its date (calc) | Due date within its severity, or set by linked work (calc) | Open High findings, so far (working) | Findings past due, so far (working) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | BF-01 | High | The ordering platform took 4 days to restore in the May full restore test. Its recovery time objective is 24 hours. | RT-02 TC-03 | Rebuild the platform's recovery (P05 TA-01), then retest end to end (RV-2027-04) | Head of IT | 30 Sep 2026 | 15 Dec 2026 | P22 OG-01; P05 TA-01; P12 GAP-03 | Open | 14 Oct 2026 | 29 Dec 2026 | Yes | No | No | Yes | BF-01 | |||
| EXAMPLE | BF-02 | High | The warehouse management system's August restore lost 24 hours of data. Dispatch can lose at most 4 hours. | RT-04 TC-04, DS-02 BC-02 | Back up the warehouse database every 4 hours (P22 OG-05), then retest the recovery point (RT-2026-11) | Head of IT | 30 Sep 2026 | 15 Dec 2026 | P22 OG-05 | Open | 14 Oct 2026 | 29 Dec 2026 | Yes | No | No | Yes | BF-01, BF-02 | |||
| EXAMPLE | BF-03 | Medium | The backup console signs in through the production directory, so an attacker with directory administrator rights could reach it. | BP-01 | Move backup administration to accounts held outside the production directory, with multi-factor authentication | Head of IT | 30 Sep 2026 | 29 Jan 2027 | P19 MP-24 | Open | 14 Oct 2026 | 29 Mar 2027 | Yes | No | No | Yes | BF-01, BF-02 | |||
| EXAMPLE | BF-04 | Medium | The online backup copies carry no retention lock. The offline copy is the only copy that production credentials cannot delete. | BP-09 | Turn on a retention lock for the full retention of each online copy | Head of IT | 30 Sep 2026 | 29 Jan 2027 | P19 MP-24 | Open | 14 Oct 2026 | 29 Mar 2027 | Yes | No | No | Yes | BF-01, BF-02 | |||
| EXAMPLE | BF-05 | Medium | The backups of the directory, the network configuration and the backup catalogue have never been restored and checked. | DS-06 BC-05 | Restore them into an isolated environment (RT-2026-10), then rebuild the foundations as a test (RV-2027-03) | Head of IT | 30 Sep 2026 | 30 Dec 2026 | P22 RV-2027-03 | Open | 14 Oct 2026 | 29 Mar 2027 | Yes | No | No | Yes | BF-01, BF-02 | |||
| EXAMPLE | BF-06 | Medium | The distributor holds no copy of the card payment records, and the payment provider's contract gives no recovery time. | DS-05 BC-02, DS-05 BC-03, DS-05 BC-06, BP-15 | Have the provider's recovery test checked against the objective, ask for a restore commitment in the contract, and record the Chief Financial Officer's decision on keeping a copy | Chief Financial Officer | 30 Sep 2026 | 13 Jan 2027 | P22 OG-07; P06 SUP-003 | Open | 14 Oct 2026 | 29 Mar 2027 | Yes | No | No | Yes | BF-01, BF-02 | |||
| EXAMPLE | BF-07 | Medium | The backup service provider's contract gives no recovery time, and its console, approval rules and encryption have not been checked. | BP-03, BP-04, BP-10 | Check the three controls and agree a restore time at the provider's assessment (P06 SUP-011) | Procurement Manager | 30 Sep 2026 | 3 Nov 2026 | P22 OG-02; P06 SUP-011 | Open | 14 Oct 2026 | 29 Mar 2027 | Yes | No | No | Yes | BF-01, BF-02 | |||
| EXAMPLE | BF-08 | Medium | The email and office backup keeps 30 days. A copy from before an attacker's earliest sign may be older. | DS-04 BC-04 | Raise the retention of the daily export to the longest need | Head of IT | 30 Sep 2026 | 13 Nov 2026 | None | Open | 14 Oct 2026 | 29 Mar 2027 | Yes | No | No | Yes | BF-01, BF-02 |
Protection controls, from the protection checklist
Record the result of each control in the Immutable & Offline Backup Protection Checklist: Met, Not met, Not checked, Not applicable. A control that is Not met or Not checked is a finding, because an unchecked protection is an unproven one.
| Row | Control ID | Severity if not met | Control | Group | Evidence to look at | What you found | Checked on | Result | Finding needed (calc) | Not met, so far (working) | Not checked, so far (working) | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | BP-01 | Medium | Backup administrator accounts are not in the production sign-in directory. | Identity | Account list of the backup system and its consoles, with where each account is held | The backup console signs in through the production directory | 30 Sep 2026 | Not met | Yes | BP-01 | ||||||||||
| EXAMPLE | BP-02 | Medium | Backup administrator accounts are named, used only for backup administration, and reviewed at planned intervals. | Identity | Account review record with the date | Four named accounts, reviewed on 28 Sep 2026 (EXAMPLE) | 28 Sep 2026 | Met | No | BP-01 | ||||||||||
| EXAMPLE | BP-03 | High | The backup system and its storage consoles require multi-factor authentication. | Identity | Console settings, or the supplier's statement for a console it runs | The provider runs this console; its assessment is planned for 3 Nov 2026 (P06 SUP-011) | Not checked | Yes | BP-01 | BP-03 | ||||||||||
| EXAMPLE | BP-04 | High | Shortening or removing a retention lock, or deleting a backup set, needs two named people. | Immutability | Console settings showing the approval rule | The provider runs this console; its assessment is planned for 3 Nov 2026 (P06 SUP-011) | Not checked | Yes | BP-01 | BP-03, BP-04 | ||||||||||
| EXAMPLE | BP-05 | High | The backup storage and the systems that manage it cannot be reached from user or server networks with ordinary or production credentials. | Isolation | Firewall rules and a failed test connection from a user device and from a production server | Firewall rules reviewed, and a test connection from a user device failed (EXAMPLE) | 29 Sep 2026 | Met | No | BP-01 | BP-03, BP-04 | |||||||||
| EXAMPLE | BP-06 | High | The offline copy is connected only while it is written or restored, and each connection is recorded. | Isolation | Connection log for the last [[three]] months | An offline copy of critical data is kept (P19 MP-24); the connection log is complete | 29 Sep 2026 | Met | No | BP-01 | BP-03, BP-04 | |||||||||
| EXAMPLE | BP-07 | Medium | No backup storage is mounted or mapped on a production system. | Isolation | Mount lists of the production systems that are backed up | No backup storage is mounted on the production servers checked (EXAMPLE) | 29 Sep 2026 | Met | No | BP-01 | BP-03, BP-04 | |||||||||
| EXAMPLE | BP-08 | High | At least one copy of each critical data set is immutable or offline. | Immutability | Coverage matrix copy list, and the lock setting or the offline media log | Every critical data set we hold copies of has an offline copy (P19 MP-24); the card payment records are held by the provider and are not ours to copy (DS-05, BP-15) | 30 Sep 2026 | Met | No | BP-01 | BP-03, BP-04 | |||||||||
| EXAMPLE | BP-09 | Medium | Each online copy that counts as immutable carries a retention lock for its full retention period. | Immutability | Lock settings with the retention period each lock holds | The online copies carry no retention lock | 30 Sep 2026 | Not met | Yes | BP-01, BP-09 | BP-03, BP-04 | |||||||||
| EXAMPLE | BP-10 | Medium | Backups are encrypted wherever they leave the organisation's control. | Encryption and keys | Encryption settings, or the supplier's statement for a store it runs | The provider runs this store; its assessment is planned for 3 Nov 2026 (P06 SUP-011) | Not checked | Yes | BP-01, BP-09 | BP-03, BP-04, BP-10 | ||||||||||
| EXAMPLE | BP-11 | High | The keys and recovery credentials for the backup system are kept outside the backed-up estate, with at least two named people able to reach them when production is down. | Encryption and keys | Key register with the location and the named people, and the date the access was last tried | Keys for the offline copies are held in a sealed envelope off site, with two named people (EXAMPLE) | 29 Sep 2026 | Met | No | BP-01, BP-09 | BP-03, BP-04, BP-10 | |||||||||
| EXAMPLE | BP-12 | Medium | Deleting a backup set, changing retention or changing the backup administrators raises an alert to someone outside backup administration. | Monitoring | Alert rule and the last test alert | An alert goes to the Head of Information Security; last test alert on 15 Sep 2026 (EXAMPLE) | 29 Sep 2026 | Met | No | BP-01, BP-09 | BP-03, BP-04, BP-10 | |||||||||
| EXAMPLE | BP-13 | Medium | Every backup job reports to a named person, and the results are reviewed each working day. | Monitoring | Job review log for the last month | The job review log is complete for September 2026 | 30 Sep 2026 | Met | No | BP-01, BP-09 | BP-03, BP-04, BP-10 | |||||||||
| EXAMPLE | BP-14 | Medium | The matrix, the backup suppliers' contacts and the instructions to recover the keys are kept where they can be reached when the main systems are down. | Reach in an outage | Where the copy is kept and the date it was last opened from there | A copy of the matrix and contacts is kept with the incident response plan (EXAMPLE) | 29 Sep 2026 | Met | No | BP-01, BP-09 | BP-03, BP-04, BP-10 | |||||||||
| EXAMPLE | BP-15 | Medium | For each cloud or software-as-a-service system holding a critical data set, what the provider backs up and for how long is recorded, with the organisation's own copy where that falls short. | Cloud and software as a service | Provider scope record for each system, and the copy list | The distributor holds no copy of the card payment records, and the provider's contract gives availability, not a recovery time (P22 DP-14) | 30 Sep 2026 | Not met | Yes | BP-01, BP-09, BP-15 | BP-03, BP-04, BP-10 |
Lists
| YesNo | DataClass | DataKind | TestType | TestStatus | Integrity | JobStatus | Severity | FindingStatus | ControlStatus |
|---|---|---|---|---|---|---|---|---|---|
| Yes | Critical | System | TT-1 | Planned | Pass | Open | High | Open | Met |
| No | Important | SaaS | TT-2 | Held | Fail | Closed | Medium | Fixed, awaiting retest | Not met |
| Other | Foundations | TT-3 | Cancelled | Not applicable | Low | Closed | Not checked | ||
| Provider-held | TT-4 | Not applicable |
TT-5
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| BAM-01 Backed up as often as the recovery point | Critical data sets whose backup interval is within the recovery point of the service that needs them (BC-02), out of those with a recovery point, with the others named. Target: All. |
| BAM-02 Copies rule met | Critical data sets that meet the copies rule (BC-03) and have no unverified copy (BC-05), out of all critical data sets, with the others named. Target: All. |
| BAM-03 Protection controls met | Protection checklist controls met, with those not met and those not checked counted and named. Target: All met; none unchecked. |
| BAM-04 Failed backup jobs | Jobs that failed out of those that ran in the period, how many were fixed within their time, how many are open, and how many took a data set outside its recovery point. Target: None open past their time. |
| BAM-05 Restore checked in time | Critical data sets with a copy of our own that were restored and checked within their class's period (BC-05), out of those with one, with the others named. Target: All. |
| BAM-06 Restored within the recovery time | Critical services restored within their recovery time objective in a test in the last 12 months, out of all (the P03 BM-06 count, from P22's tests). Target: All. |
| BAM-07 Data lost within the recovery point in tests | Timed tests in the last 12 months whose data lost was within the recovery point, out of the tests that measured it. Target: All. |
| BAM-08 Findings open and past due | Findings not yet closed, with the High findings and those past their due date named. Target: No High finding past due. |
| Data set | A body of data that is backed up and restored as a unit, such as one database, one file share or one mail tenant. Each data set has an owner, a class and a place in the coverage matrix (BR-01). |
| Data owner | The manager accountable for a data set. For the data a critical service needs, this is the service's business owner (P22 RR-02). |
| 3-2-1-1-0 rule | The 3-2-1-1-0 rule of thumb: at least three copies of the data, on two kinds of storage, one copy offsite, one copy immutable or offline, and zero copies whose restore has not been checked. It is a practice used in industry, not a legal requirement. BR-03 and BR-04 set it. |
| Unverified copy | A copy of a critical data set that has not been restored and checked for integrity within the restore check period for its class (BR-04). |
| Class | How much the organisation depends on a data set: Critical, Important or Other (CLASSES). The class sets how often it is restored in a test (BR-13). |
| Restore test | A test that restores data from a backup and checks the result against the pass criteria (BR-14). A tabletop, a drill or any other exercise is not a restore test (P22 RR-14). |
| Critical service | A service the organisation delivers whose disruption beyond its maximum tolerable downtime would cause Severe harm on the risk register's impact scale (RR-01). It is a business service, such as online ordering, not a system. |
| Recovery time objective (RTO) | Recovery time objective: the time within which the service must be back, counted from the decision to recover it. Always shorter than the MTD (RR-04). |
| Recovery point objective (RPO) | Recovery point objective: the most data, measured in time, the service can lose. The backup interval of every data set it needs must be no longer (RR-04, MX-03). |
| Cyber recovery time | The time a service would take to come back after a destructive attack: the foundations' rebuild, if the service depends on them, plus the slowest of the systems the organisation restores itself (MX-05). |
| Finding | A failed pass criterion, a failed check, an unmet protection control or a repeated job failure, with an owner, a severity and a due date (BR-18). |
| Met | The check, criterion or control is satisfied by the facts entered. This is a count of what you entered, not a statement about any law or standard. |
| Not checked | Nobody has checked the control. It counts as a finding, because an unchecked protection is an unproven one. |
| Not applicable | The check does not apply, such as the recovery point of the foundations, or a restore check of data only a provider holds. |
| Failed | At least one pass criterion of the restore test is not met (BR-14). The test raises a finding for each. |
| Not a restore test | A test that restores no backup, such as a supplier's failover. It counts for the recovery time and recovery point measures where it measured them, and for no restore check. |
| Restore check period | The months within which a critical data set's copy must be restored and checked for integrity, set by its class (BR-13). |
| As-at date | The date every status, date and measure is worked out at: the quarter's last day. |
| Resilience coordinator | Keeps the findings tracker, plans the year's restore tests with the backup owner, and reports. |
| Approver | Approves the backup standard and receives the yearly report. |
| (calc), (working) | A column or cell the workbook calculates. Do not type or paste over it. Working columns hold running lists other cells read. |
| BR-nn, BC-nn, BP-nn, TC-nn, BAM-nn | The rules, coverage checks, protection controls, pass criteria and headline measures. The Restore Testing Methodology sets the rules and pass criteria, the Backup Coverage & Retention Matrix the checks, the Immutable & Offline Backup Protection Checklist the controls. DS-nn are data sets, RT-nn restore tests, FJ-nn failed jobs and BF-nn findings. |
| EXAMPLE | A worked example: a wholesale distributor as at 30 Sep 2026, after INC-2026-014. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 9.1 — Monitoring, measurement, analysis and evaluation | The dashboard as a whole: what is measured about backups and restores, when, and how the results are evaluated and reported |
| ISO/IEC 27001:2022 | Clause 9.3 — Management review | Dashboard sheet: the yearly page gives [[the approver]] results on backup assurance to consider at management review |
| ISO/IEC 27001:2022 | Annex A 8.13 — Information backup | Data Sets, Tests and Findings and Controls sheets: the backups, their protection and the restore tests the dashboard counts |
| NIST CSF 2.0 | ID.IM-02 — “Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties” | Dashboard sheet: improvements identified from restore tests and the findings they raise, with the decision each measure supports |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(c) — “business continuity, such as backup management and disaster recovery, and crisis management” | The dashboard as a whole: a regular count of whether backups are made, protected and restored, with every gap named |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Applies to the providers its Article 1 names. For them, the Annex points below; for others, a useful guide only |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.2.6 — “The relevant entities shall carry out regular testing of the recovery of backup copies and redundancies to ensure that, in recovery conditions, they can be relied upon and cover the copies, processes and knowledge to perform an effective recovery. The relevant entities shall document the results of the tests and, where needed, take corrective action.” | Tests sheet, BAM-05 to BAM-07: restore tests recorded with the time achieved and the data lost, and the findings they raise on the Findings and Controls sheet (providers Article 1 names) |
| DORA — Regulation (EU) 2022/2554 | Article 12(2) — backup systems can be activated in accordance with the backup policies and the restoration and recovery procedures; “The activation of backup systems shall not jeopardise the security of the network and information systems or the availability, authenticity, integrity or confidentiality of data. Testing of the backup procedures and restoration and recovery procedures and methods shall be undertaken periodically.” | Tests sheet, for financial entities other than those of Article 16(1): the dates and results of restore tests. Backup protection is on the Findings and Controls sheet |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 40(3) — the results of the testing are documented, and identified deficiencies “shall be analysed, addressed, and reported to the management body” | Findings and Controls sheet, for the entities of DORA Article 16(1): test results recorded, and each deficiency named, addressed and reported |
| NIST SP 800-209 (October 2020) | Section 4.8, RA-SS-R12 — the recommendations are reviewed in a periodic audit; “Gaps should be identified, tracked, and remediated.” The frequency “should match sensitivity and value of protected data, but no less than once per year”, and audit results should be documented | Findings and Controls sheet and the report pages: gaps identified, tracked and remediated, with results documented (guidance only) |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774; Regulation (EU) 2016/679 (GDPR); NIST SP 800-209 (October 2020); NCSC (UK) blog post "Offline backups in an online world" (2019)
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. They do not say that meeting one meets any other framework's requirement.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.