Immutable & Offline Backup Protection Checklist

Verifies backups are protected from ransomware through immutability, isolation and separate credentials.

Available soon

Format: Excel
Size: 75 KB
Length: 10 sheets
Version: 1.0
Updated: 2 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.02 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Use this workbook once a year, and after any change to the backup system or its supplier. The Controls Explained sheet says what each control means, why it exists and how to check it. Read it before the first review.
2	The protection reviewer completes the checklist. The reviewer must not administer the backup system, so that nobody marks their own work (Protection reviewer: reviews the protection checklist and the evidence behind each answer.).
3	Fill "This review" at the top. Make a copy of the Checklist sheet for each separate backup estate, for example one for each site or each backup platform: right-click the tab, choose Move or Copy, tick Create a copy, and name the copy. Each copy calculates on its own.
4	Start with the copy table at the foot of the sheet. For each data set in the Backup Coverage & Retention Matrix, enter its class, its kind, and how many copies, kinds of storage, offsite copies and immutable or offline copies it has. The live data counts as one copy. The sheet works out whether each data set meets the copies rule (BR-03).
5	For each control, look at the evidence in the "Evidence to look at" column. Choose the Status: Met, Not met, Not checked or Not applicable. Enter the date, who checked it and where the evidence is kept. Met, Not met and Not applicable count only once they are dated and signed.
6	Use Not checked when you have not seen the evidence yourself, including when a supplier runs the console and has not yet shown it to you. An unchecked protection is an unproven one, so it needs a finding too (BR-18).
7	Use Not applicable only when the control cannot apply to your estate, and write the reason in the note. The sheet does not accept Not applicable without one.
8	For every control that is Not met or Not checked, raise a finding in your Backup Failure & Restore Findings Tracker and write its number in the Finding column. The Finding check column reads "Raise a finding (BR-18)" until you do. Severity if not met is a starting point: the owner sets the severity of the finding (BR-18).
9	Read the BP-08 cross-check. It compares your answer with the copy table. A critical data set that you hold copies of, and that has no immutable or offline copy, means BP-08 is not met, whatever else is true. Data a provider holds, with no copy of yours, is covered by BP-15.
10	Read the counts at the top. They show how many controls are met, not met and not checked, group by group. A good review has none of the last two. Do not turn the counts into a score or a share (BR-21).
11	Tell the resilience coordinator the result. Keep each completed checklist with the evidence it points to, for at least as long as your restore test records (BR-17). Keep a copy off the main systems, where it can be reached in an outage (BP-14).
12	To clear the EXAMPLE, delete the EXAMPLE Checklist sheet. The Checklist sheet is already blank. The controls stay: they are the standard. Add controls of your own on the yellow rows at the foot of the control table, with an ID from BP-16.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

BR-03: Each critical data set has at least [[3]] copies of the data (the live data and two backups), on at least [[2]] kinds of storage or media, with at least [[1]] copy offsite and at least [[1]] copy that is immutable or offline. The immutable or offline copy cannot be changed or deleted with production administrator credentials (P22 RR-11), nor with the everyday credentials of the backup administrators (BR-06).

BR-06: The backup system, its storage and its management consoles are administered with accounts that are separate from the production sign-in directory, used only for backup administration, protected by multi-factor authentication and held by named people. No one holds both production domain administrator rights and the right to delete an immutable copy or shorten its retention. During an incident, P09 C4 applies.

BR-07: The backup storage and the systems that manage it cannot be reached from user or server networks with ordinary or production credentials. An offline copy is connected only while it is written or restored, and each connection is recorded. A restore from an immutable or offline copy goes to an isolated place (P22 RR-13), never straight onto production.

BR-08: Each immutable copy carries a retention lock for its full retention period. Shortening or removing a lock needs two named people and a recorded reason. A lock that administrator credentials alone can remove does not make a copy immutable.

BR-09: Backups are encrypted wherever they leave the organisation's control. The keys and the recovery credentials for the backup system are kept outside the estate that is backed up, can be reached by at least two named people when production is down, and are proved in a restore test. A backup whose key cannot be found is treated as lost.

BR-19: For every cloud or software-as-a-service system that holds a critical data set, the data owner records what the provider backs up, for how long and how it restores, and what it leaves out, such as deleted items, data changed by an attacker and administrator errors. Where the provider's commitment is shorter than the data set's recovery point or retention, the organisation keeps its own copy outside the provider's account. The tenant restore is tested (TT-5).

P22 RR-11: Each critical data set is backed up at least as often as its service's recovery point requires, and at least one copy cannot be changed or deleted with production administrator credentials. Copies are checked for integrity before they are restored (P09 IM-10). How often other restore checks run, and how they are judged, is set by the Backup & Restore Assurance pack (P23).

Why a checklist. Backup success is not recovery success. A backup job that finished says only that the job wrote something. It says nothing about whether the data restores, whether it restores within the time the service can wait, or whether the copy is one an attacker holding your administrator credentials could not have reached and deleted first. Only a restore shows that the copy is complete, that it opens, that the keys to it still exist, and how long recovery takes. Attackers look for the backups first, so protecting the copies and proving the restore are one piece of work.

This document helps you set up backups, protect them and prove that they restore. It is not legal advice, and following it is not a statement that you comply with NIS2, DORA, the GDPR or any standard. Which backup and testing duties apply to you depends on your sector and your national law: confirm them with counsel or your supervisor.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. The EXAMPLE Checklist sheet shows its protection review. It follows the coverage and the findings the pack's other documents hold for it.

Adapting this template.

Small organisation: keep every control. If a supplier or your IT provider runs the backups, ask for the evidence in the column and mark the control Not checked until you have seen it. A statement in writing counts as evidence for a console the supplier runs.

IT run by a service provider: the provider may complete the evidence, and your protection reviewer checks it. The reviewer must be someone who cannot change the backup system.

Cloud and software-as-a-service data: the copy table and BP-15 are the part that matters most. If the provider holds the only copy, list the data set, set its kind to Provider-held and raise a finding for BP-15.

Controls of your own: add them on the yellow rows at the foot of the control table. They count in the totals and the group counts you give them.

This workbook is your own record. Keep it with your backup standard and your findings tracker.

Checklist

Backup protection review: [[estate or site]]

One copy of this sheet for each review of a backup estate. Yellow cells are yours. Result now, the finding check, every count and the copies rule calculate. Counts only, never a score.

This review

What is reviewed			[[The backup system, its storage and the data sets it covers]]
Date of the review			[[YYYY-MM-DD]]
Protection reviewer			[[Protection reviewer: name]]
Backup owner			[[Backup owner: name]]
Parts a supplier runs			[[Which consoles and stores a supplier runs, and who]]

Where the controls stand

Controls met, not met and not checked				0 of 15 met; 0 not met; 0 not checked; 15 not yet answered or signed
Findings to raise (BR-18)				No finding needed
Critical data sets that meet the copies rule (BR-03)

By group

Group				Controls	Met	Not met	Not checked	Not applicable
Identity				3	0	0	0	0
Immutability				3	0	0	0	0
Isolation				3	0	0	0	0
Encryption and keys				2	0	0	0	0
Monitoring				2	0	0	0	0
Reach in an outage				1	0	0	0	0
Cloud and software as a service				1	0	0	0	0
All controls, including your own				15	0	0	0	0

Counts of controls, never a share (BR-21). A control of your own is counted in the last row, and in a group only if its group is one of the above.

The controls, BP-01 to BP-15

Control	Group	Control: what must be true	Evidence to look at	Rule	Severity if not met	Result now	Cross-check with the copy table
BP-01	Identity	Backup administrator accounts are not in the production sign-in directory.	Account list of the backup system and its consoles, with where each account is held	BR-06	Medium	Not answered
BP-02	Identity	Backup administrator accounts are named, used only for backup administration, and reviewed at planned intervals.	Account review record with the date	BR-06	Medium	Not answered
BP-03	Identity	The backup system and its storage consoles require multi-factor authentication.	Console settings, or the supplier's statement for a console it runs	BR-06	High	Not answered
BP-04	Immutability	Shortening or removing a retention lock, or deleting a backup set, needs two named people.	Console settings showing the approval rule	BR-08	High	Not answered
BP-05	Isolation	The backup storage and the systems that manage it cannot be reached from user or server networks with ordinary or production credentials.	Firewall rules and a failed test connection from a user device and from a production server	BR-07	High	Not answered
BP-06	Isolation	The offline copy is connected only while it is written or restored, and each connection is recorded.	Connection log for the last [[three]] months	BR-07	High	Not answered
BP-07	Isolation	No backup storage is mounted or mapped on a production system.	Mount lists of the production systems that are backed up	BR-07	Medium	Not answered
BP-08	Immutability	At least one copy of each critical data set is immutable or offline.	Coverage matrix copy list, and the lock setting or the offline media log	BR-03	High	Not answered	Fill the copy table
BP-09	Immutability	Each online copy that counts as immutable carries a retention lock for its full retention period.	Lock settings with the retention period each lock holds	BR-08	Medium	Not answered
BP-10	Encryption and keys	Backups are encrypted wherever they leave the organisation's control.	Encryption settings, or the supplier's statement for a store it runs	BR-09	Medium	Not answered
BP-11	Encryption and keys	The keys and recovery credentials for the backup system are kept outside the backed-up estate, with at least two named people able to reach them when production is down.	Key register with the location and the named people, and the date the access was last tried	BR-09	High	Not answered
BP-12	Monitoring	Deleting a backup set, changing retention or changing the backup administrators raises an alert to someone outside backup administration.	Alert rule and the last test alert	BR-06	Medium	Not answered
BP-13	Monitoring	Every backup job reports to a named person, and the results are reviewed each working day.	Job review log for the last month	BR-11	Medium	Not answered
BP-14	Reach in an outage	The matrix, the backup suppliers' contacts and the instructions to recover the keys are kept where they can be reached when the main systems are down.	Where the copy is kept and the date it was last opened from there	BR-22	Medium	Not answered
BP-15	Cloud and software as a service	For each cloud or software-as-a-service system holding a critical data set, what the provider backs up and for how long is recorded, with the organisation's own copy where that falls short.	Provider scope record for each system, and the copy list	BR-19	Medium	Not answered

Copies of each data set (the evidence for BP-08)

The copies rule you set (BR-03): at least				Copies	Kinds of storage	Offsite	Immutable or offline
The rule counts the live data as one copy. Change the numbers if your backup standard sets others.				3	2	1	1

One row for each critical data set, and for each other data set you back up. Enter the counts from your coverage matrix. The live data counts as one copy.

Data set	Class	Data set name	Copies rule: result and shortfall	Copies	Kinds of storage	Offsite	Immutable or offline	Kind of data set	Immutable or offline copy: where it is held	Copies rule met?

Sign-off

Role	Name	Date	Signature or reference
Checked (Protection reviewer)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Accepted (Backup owner)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Findings passed on (Resilience coordinator)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]

EXAMPLE Checklist

EXAMPLE: the distributor's backup protection review

a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. The review follows INC-2026-014 and the pack's findings. Yellow cells are the reviewer's. Result now, the finding check, the counts and the copies rule calculate.

This review

What is reviewed			The backup platform, its storage and the offline copies of the six data sets in the coverage matrix (DS-01 to DS-06)
Date of the review			30 Sep 2026
Protection reviewer			Protection reviewer: Head of Information Security
Backup owner			Backup owner: Head of IT
Parts a supplier runs			Backup service provider (P06 SUP-011): its consoles, approval rules and encryption. Its assessment is planned for 3 Nov 2026.

Where the controls stand

Controls met, not met and not checked				9 of 15 met; 3 not met; 3 not checked
Findings to raise (BR-18)				6 of 6 findings raised
Critical data sets that meet the copies rule (BR-03)				5 of 6

By group

Group	Controls	Met	Not met	Not checked
Identity	3	1	1	1
Immutability	3	1	1	1
Isolation	3	3	0	0
Encryption and keys	2	1	0	1
Monitoring	2	2	0	0
Reach in an outage	1	1	0	0
Cloud and software as a service	1	0	1	0
All controls, including your own	15	9	3	3

Counts of controls, never a share (BR-21). A control of your own is counted in the last row, and in a group only if its group is one of the above.

The controls, BP-01 to BP-15

Control	Group	Control: what must be true	Evidence to look at	Rule	Severity if not met	Status	Date checked	Checked by	Evidence reference and note	Finding	Result now	Finding check	Cross-check with the copy table
BP-01	Identity	Backup administrator accounts are not in the production sign-in directory.	Account list of the backup system and its consoles, with where each account is held	BR-06	Medium	Not met	30 Sep 2026	Head of Information Security	The backup console signs in through the production directory	BF-03	Not met	Finding BF-03
BP-02	Identity	Backup administrator accounts are named, used only for backup administration, and reviewed at planned intervals.	Account review record with the date	BR-06	Medium	Met	28 Sep 2026	Head of Information Security	Four named accounts, reviewed on 28 Sep 2026 (EXAMPLE)		Met
BP-03	Identity	The backup system and its storage consoles require multi-factor authentication.	Console settings, or the supplier's statement for a console it runs	BR-06	High	Not checked			The provider runs this console; its assessment is planned for 3 Nov 2026 (P06 SUP-011)	BF-07	Not checked	Finding BF-07
BP-04	Immutability	Shortening or removing a retention lock, or deleting a backup set, needs two named people.	Console settings showing the approval rule	BR-08	High	Not checked			The provider runs this console; its assessment is planned for 3 Nov 2026 (P06 SUP-011)	BF-07	Not checked	Finding BF-07
BP-05	Isolation	The backup storage and the systems that manage it cannot be reached from user or server networks with ordinary or production credentials.	Firewall rules and a failed test connection from a user device and from a production server	BR-07	High	Met	29 Sep 2026	Head of Information Security	Firewall rules reviewed, and a test connection from a user device failed (EXAMPLE)		Met
BP-06	Isolation	The offline copy is connected only while it is written or restored, and each connection is recorded.	Connection log for the last [[three]] months	BR-07	High	Met	29 Sep 2026	Head of Information Security	An offline copy of critical data is kept (P19 MP-24); the connection log is complete		Met
BP-07	Isolation	No backup storage is mounted or mapped on a production system.	Mount lists of the production systems that are backed up	BR-07	Medium	Met	29 Sep 2026	Head of Information Security	No backup storage is mounted on the production servers checked (EXAMPLE)		Met
BP-08	Immutability	At least one copy of each critical data set is immutable or offline.	Coverage matrix copy list, and the lock setting or the offline media log	BR-03	High	Met	30 Sep 2026	Head of Information Security	Every critical data set we hold copies of has an offline copy (P19 MP-24); the card payment records are held by the provider and are not ours to copy (DS-05, BP-15)		Met		Agrees with the copy table
BP-09	Immutability	Each online copy that counts as immutable carries a retention lock for its full retention period.	Lock settings with the retention period each lock holds	BR-08	Medium	Not met	30 Sep 2026	Head of Information Security	The online copies carry no retention lock	BF-04	Not met	Finding BF-04
BP-10	Encryption and keys	Backups are encrypted wherever they leave the organisation's control.	Encryption settings, or the supplier's statement for a store it runs	BR-09	Medium	Not checked			The provider runs this store; its assessment is planned for 3 Nov 2026 (P06 SUP-011)	BF-07	Not checked	Finding BF-07
BP-11	Encryption and keys	The keys and recovery credentials for the backup system are kept outside the backed-up estate, with at least two named people able to reach them when production is down.	Key register with the location and the named people, and the date the access was last tried	BR-09	High	Met	29 Sep 2026	Head of Information Security	Keys for the offline copies are held in a sealed envelope off site, with two named people (EXAMPLE)		Met
BP-12	Monitoring	Deleting a backup set, changing retention or changing the backup administrators raises an alert to someone outside backup administration.	Alert rule and the last test alert	BR-06	Medium	Met	29 Sep 2026	Head of Information Security	An alert goes to the Head of Information Security; last test alert on 15 Sep 2026 (EXAMPLE)		Met
BP-13	Monitoring	Every backup job reports to a named person, and the results are reviewed each working day.	Job review log for the last month	BR-11	Medium	Met	30 Sep 2026	Head of Information Security	The job review log is complete for September 2026		Met
BP-14	Reach in an outage	The matrix, the backup suppliers' contacts and the instructions to recover the keys are kept where they can be reached when the main systems are down.	Where the copy is kept and the date it was last opened from there	BR-22	Medium	Met	29 Sep 2026	Head of Information Security	A copy of the matrix and contacts is kept with the incident response plan (EXAMPLE)		Met
BP-15	Cloud and software as a service	For each cloud or software-as-a-service system holding a critical data set, what the provider backs up and for how long is recorded, with the organisation's own copy where that falls short.	Provider scope record for each system, and the copy list	BR-19	Medium	Not met	30 Sep 2026	Head of Information Security	The distributor holds no copy of the card payment records, and the provider's contract gives availability, not a recovery time (P22 DP-14)	BF-06	Not met	Finding BF-06

Copies of each data set (the evidence for BP-08)

The copies rule you set (BR-03): at least				Copies	Kinds of storage	Offsite	Immutable or offline
The rule counts the live data as one copy. Change the numbers if your backup standard sets others.				3	2	1	1

One row for each critical data set, and for each other data set you back up. Enter the counts from your coverage matrix. The live data counts as one copy.

Data set	Class	Data set name	Copies rule: result and shortfall	Copies	Kinds of storage	Offsite	Immutable or offline	Kind of data set	Immutable or offline copy: where it is held	Copies rule met?
DS-01	Critical	Orders and customer accounts	3 copies, 3 kinds, 2 offsite, 1 immutable or offline	3	3	2	1	System	Offline copy (offline media)	Meets
DS-02	Critical	Stock and dispatch records	3 copies, 3 kinds, 2 offsite, 1 immutable or offline	3	3	2	1	System	Offline copy (offline media)	Meets
DS-03	Critical	Ledgers and payroll records	3 copies, 3 kinds, 2 offsite, 1 immutable or offline	3	3	2	1	SaaS	Nightly export (offline media)	Meets
DS-04	Critical	Email and office documents	3 copies, 3 kinds, 2 offsite, 1 immutable or offline	3	3	2	1	SaaS	Weekly offline copy (offline media)	Meets
DS-05	Critical	Card payment records	1 of 3 copies; 1 of 2 kinds of storage; 0 of 1 offsite; 0 of 1 immutable or offline	1	1	0	0	Provider-held	None held by us	Does not meet
DS-06	Critical	Directory, network configuration, backup catalogue and build images	3 copies, 3 kinds, 2 offsite, 1 immutable or offline	3	3	2	1	Foundations	Offline golden images and baselines (offline media)	Meets

Sign-off

Role	Name	Date	Signature or reference
Checked (Protection reviewer)	Head of Information Security	[[YYYY-MM-DD]]	[[Reference]]
Accepted (Backup owner)	Head of IT	[[YYYY-MM-DD]]	[[Reference]]
Findings passed on (Resilience coordinator)	Head of Risk	[[YYYY-MM-DD]]	[[Reference]]

What the review found. 9 of 15 met; 3 not met; 3 not checked (Backup Assurance Dashboard, BAM-03). Each of the six that are not met or not checked has a finding in the Backup Failure & Restore Findings Tracker: BF-03, BF-04, BF-06, BF-07.

Three controls are not checked. The backup service provider runs those consoles and stores, and has not been assessed (P06 SUP-011, planned for 3 Nov 2026). BP-03, BP-04, BP-10 stay Not checked until its evidence is seen. An unchecked protection is an unproven one (BR-18).

The offline copy. P19 MP-24 reports an offline copy of critical data, so BP-06 and BP-08 are met. The online copies carry no retention lock (BP-09), and the backup console signs in through the production directory (BP-01). Today the offline copy is the only copy that production credentials cannot delete.

Card payment records. The payment provider holds the data and the distributor holds no copy of it (DS-05). The copy table shows it failing the copies rule, BP-08 is answered for the data sets the distributor holds copies of, and BP-15 records the gap.

Controls Explained

What each control means, why it exists and how to check it

Backup success is not recovery success. A backup job that finished says only that the job wrote something. It says nothing about whether the data restores, whether it restores within the time the service can wait, or whether the copy is one an attacker holding your administrator credentials could not have reached and deleted first. Only a restore shows that the copy is complete, that it opens, that the keys to it still exist, and how long recovery takes. Attackers look for the backups first, so protecting the copies and proving the restore are one piece of work.

The 15 controls

Control	Group	What it means	Why it exists	How to check it	Rule	Severity if not met
BP-01	Identity	The accounts that run the backups are not accounts in the production sign-in directory.	An attacker who takes over the directory can sign in as anyone in it. If the backup console trusts the directory, the attacker reaches the backups too.	List the accounts on the backup system and its consoles, and mark where each one is held. None may be held in the production directory.	BR-06	Medium
BP-02	Identity	Each backup administrator has a named account, used only for backup work, and the list is reviewed on a schedule.	Shared or everyday accounts hide who did what. They also gather rights that nobody remembers granting.	Open the latest account review. It shows a date and the reviewer. Compare its list with the people who run the backups today.	BR-06	Medium
BP-03	Identity	Signing in to the backup system and its storage consoles needs a second factor.	A stolen password alone then does not open the backups.	Read the console's sign-in settings. For a console the supplier runs, ask the supplier to state the setting in writing.	BR-06	High
BP-04	Immutability	Shortening a retention lock, removing it or deleting a backup set needs two named people.	One stolen or forced account cannot then wipe the copies. The attacker needs a second person, and you get a record.	Show the console's approval rule. On a test set, try the action with one account and confirm it is refused.	BR-08	High
BP-05	Isolation	Nothing on a user or server network can reach the backup storage, or the systems that manage it, with an ordinary or production sign-in.	Ransomware spreads across every network it can reach. Backups on those networks are encrypted or deleted with everything else.	Read the firewall rules. Then try to reach the storage from a user device and from a production server. Both attempts must fail. Keep the failed attempts as evidence.	BR-07	High
BP-06	Isolation	The offline copy is connected only while it is written or restored, and each connection is logged.	A copy that stays connected is an online copy, whatever it is called. The log shows that the gap is real.	Read the connection log for the period shown. Every connection has a reason, a date and a person. Look for gaps and for long connections.	BR-07	High
BP-07	Isolation	No backup storage is mounted or mapped on a production system.	A mounted volume looks like a local disk to malware, which encrypts it like any other disk.	On each backed-up system, list the mounted and mapped drives. None may point to backup storage.	BR-07	Medium
BP-08	Immutability	At least one copy of each critical data set is immutable or offline.	This is the copy that survives an attacker holding administrator credentials. The other controls make that copy hard to reach. This one makes sure it exists.	Use the copy table on this sheet. For each critical data set, show the lock setting or the offline media log for its immutable or offline copy.	BR-03	High
BP-09	Immutability	Each online copy that counts as immutable carries a retention lock for its full retention period.	A lock that ends before the retention does leaves the copy open to deletion for the rest of the period.	Read the lock setting of each such copy. Compare the lock period with the retention period in the coverage matrix.	BR-08	Medium
BP-10	Encryption and keys	Backups are encrypted wherever they leave the organisation's control.	A lost disk, a supplier's error or a stolen export then exposes nothing readable.	Read the encryption settings of each store and each transfer. For a store the supplier runs, ask for its written statement.	BR-09	Medium
BP-11	Encryption and keys	The keys and recovery credentials for the backup system are kept outside the backed-up estate, and two named people can reach them when production is down.	A backup whose key cannot be found is treated as lost (BR-09). Keys held on the system they unlock disappear with it.	Open the key register and check each key's location and its two named people. Ask one of them to reach a key without any production system, and record the date.	BR-09	High
BP-12	Monitoring	Deleting a backup set, changing retention or changing the backup administrators sends an alert to someone outside backup administration.	These are an attacker's first moves against backups. An administrator account that the attacker has taken over will not report them.	Read the alert rule. Trigger a test alert and confirm who received it and when.	BR-06	Medium
BP-13	Monitoring	Every backup job reports to a named person, and the results are reviewed each working day.	A job that fails unnoticed leaves a data set without a recent copy.	Read the job review log for the last month. Every working day has an entry, and every failure has an action.	BR-11	Medium
BP-14	Reach in an outage	The coverage matrix, the suppliers' contacts and the instructions to recover the keys are kept where people can reach them when the main systems are down.	In an outage the first needs are to know what to restore and whom to call. Those documents often sit on the systems that are down.	Open the copy from where it is kept, without the main systems, and record the date you did.	BR-22	Medium
BP-15	Cloud and software as a service	For each cloud or software-as-a-service system that holds a critical data set, you know what the provider backs up and for how long, and you hold your own copy where that falls short.	A provider's backup may leave out deleted items, changes an attacker made and administrator errors (BR-19).	Read the provider scope record for each system. Compare its backup period, and what it leaves out, with the data set's recovery point and retention.	BR-19	Medium

Severity if not met

Severity	What a finding means (BR-18)	Days to a fix
High	A finding of this severity is fixed within the days shown from the day it is raised. The owner sets the severity when the finding is raised.	90
Medium	A finding of this severity is fixed within the days shown from the day it is raised. The owner sets the severity when the finding is raised.	180
Low	A finding of this severity is fixed within the days shown from the day it is raised. The owner sets the severity when the finding is raised.	365

Where a control is Not checked, the finding is raised in the same way. The finding takes the severity its owner judges while the control is unproven, and the control's own severity if a check then finds it not met.

Lists

ControlStatus	Severity	DataClass	DataKind
Met	High	Critical	System
Not met	Medium	Important	SaaS
Not checked	Low	Other	Foundations
Not applicable			Provider-held

Definitions

Definitions

Term	Meaning in this workbook
Backup success	A backup job that finished. It says only that the job wrote something. It does not show that the data restores, or that the copy is out of an attacker's reach.
Control (BP-nn)	One of BP-01 to BP-15: something that must be true to keep backups out of an attacker's reach, with the evidence that shows it.
BR-nn	The rules of the Restore Testing Methodology, which set the backup standard. A reference with a pack, such as P09 C4 or P22 RR-11, is that pack's.
Met	You have seen the evidence yourself and it shows the control is true. It counts once dated and signed.
Not met	The evidence shows the control is false. It needs a finding. It counts once dated and signed.
Not checked	You have not seen the evidence. It needs a finding too, because an unchecked protection is an unproven one (BR-18).
Not applicable	The control cannot apply to your estate. The note must say why. It counts once dated and signed.
Not answered	The control has no status yet. It is counted in none of the totals.
Result now	What the sheet counts: the status, once it is dated and signed, or a message saying what is missing.
Finding check	Reads Raise a finding for a control that is not met or not checked and has no finding number yet.
Copies rule	The 3-2-1-1-0 rule of thumb: at least three copies of the data, on two kinds of storage, one copy offsite, one copy immutable or offline, and zero copies whose restore has not been checked. It is a practice used in industry, not a legal requirement. BR-03 and BR-04 set it.
Copy	One stored version of a data set. The live data counts as one copy.
Data set	A body of data that is backed up and restored as a unit, such as one database, one file share or one mail tenant. Each data set has an owner, a class and a place in the coverage matrix (BR-01).
Critical service	A service the organisation delivers whose disruption beyond its maximum tolerable downtime would cause Severe harm on the risk register's impact scale (RR-01). It is a business service, such as online ordering, not a system.
Class	How much the organisation depends on a data set: Critical, Important or Other (CLASSES). The class sets how often it is restored in a test (BR-13).
Immutable copy	A copy that nobody can change or delete, with administrator credentials or otherwise, until its retention lock expires (BR-08).
Offline copy	A copy that is disconnected from every network except while it is written or restored (BR-07).
Retention lock	A setting on a stored copy that stops anyone shortening its retention or deleting it. Removing it needs two named people and a recorded reason (BR-08).
Backup administrator	A person who runs the backup system, its storage or its consoles. Backup administrators use their own accounts (BR-06).
Software-as-a-service data	Data the organisation holds in a cloud or software-as-a-service system, where the provider runs the platform. The provider's backup may not cover deleted items, changes made by an attacker or administrator errors (BR-19).
Tenant	One organisation's own area inside a provider's cloud or software-as-a-service system, such as its mail and document service.
Finding	A failed pass criterion, a failed check, an unmet protection control or a repeated job failure, with an owner, a severity and a due date (BR-18).
Protection reviewer	Reviews the protection checklist and the evidence behind each answer.
Backup owner	Is accountable for the backup system, its protection and the restore tests, and for fixing findings.
Backup administrator	Runs the backup jobs, reviews their results each working day, fixes failures and runs restore tests.
Resilience coordinator	Keeps the findings tracker, plans the year's restore tests with the backup owner, and reports.
EXAMPLE	An illustration: the protection review of a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026, with the values the pack's other documents hold for it.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 8.13 — Information backup	The checklist as a whole: the protection of backup copies
ISO/IEC 27001:2022	Annex A 8.2 — Privileged access rights	BP-01 to BP-04: separate accounts, with the right to delete an immutable copy held apart from production administration
ISO/IEC 27001:2022	Annex A 8.5 — Secure authentication	BP-03: multi-factor authentication on the backup consoles
ISO/IEC 27001:2022	Annex A 8.15 — Logging	BP-12 and BP-13: alerts on changes to backups, and the daily review of job results
ISO/IEC 27001:2022	Annex A 8.24 — Use of cryptography	BP-10 and BP-11: encryption of backups, and the keys kept outside the estate
NIST CSF 2.0	PR.DS-01 — “The confidentiality, integrity, and availability of data-at-rest are protected”	BP-05 to BP-10: data at rest, including backups, protected from change and deletion
NIST CSF 2.0	PR.DS-11 — “Backups of data are created, protected, maintained, and tested”	BP-08, BP-13 and the copy table: backups created, protected, maintained and tested
NIST CSF 2.0	PR.AA-05 — “Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties”	BP-01, BP-02 and BP-04: least privilege and separation of duties for backup administration
NIS2 — Directive (EU) 2022/2555	Article 21(2)(c) — “business continuity, such as backup management and disaster recovery, and crisis management”	The checklist as a whole: backup management as part of business continuity
NIS2 — Implementing Regulation (EU) 2024/2690	Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers	Applies only to the providers its Article 1 names; for them, the Annex points below. Others, such as the example distributor, may use them as good practice
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 4.2.2 — based on the risk assessment (point 2.1) and the business continuity plan, backup plans that include: “recovery times”; “assurance that backup copies are complete and accurate, including configuration data and data stored in cloud computing service environment”; “storing backup copies (online or offline) in a safe location or locations, which are not in the same network as the system, and are at sufficient distance to escape any damage from a disaster at the main site”; “appropriate physical and logical access controls to backup copies, in accordance with the asset classification level”; “restoring data from backup copies”; and “retention periods based on business and regulatory requirements”	BP-01 to BP-08, for those providers: backup copies stored online or offline, outside the system's network, with physical and logical access controls
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 9.2(c) — the cryptography policy and procedures establish the entity’s approach to key management, including, where appropriate, methods for storing keys, dealing with compromised keys, “recovering lost or corrupted keys” and “backing up or archiving keys”	BP-11, for those providers: where keys are stored, and recovering and backing up keys
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 11.3.2 — the policies for privileged accounts and system administration accounts establish strong identification and authentication “such as multi-factor authentication”, “set up specific accounts to be used for system administration operations exclusively”, and “provide that system administration accounts are only used to connect to system administration systems”	BP-01 to BP-03, for those providers: separate administration accounts and multi-factor authentication
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 11.4.2 — the relevant entities “only use system administration systems for system administration purposes, and not for any other operations”, “separate logically such systems from application software not used for system administrative purposes” and “protect access to system administration systems through authentication and encryption”	BP-01 and BP-05, for those providers: administration systems used only for administration and separated from other systems
DORA — Regulation (EU) 2022/2554	Article 12(2) — backup systems can be activated in accordance with the backup policies and the restoration and recovery procedures; “The activation of backup systems shall not jeopardise the security of the network and information systems or the availability, authenticity, integrity or confidentiality of data. Testing of the backup procedures and restoration and recovery procedures and methods shall be undertaken periodically.”	BP-05 to BP-07, for financial entities: backup systems that do not put the network or the data at risk
DORA — Regulation (EU) 2022/2554	Article 12(3) — “When restoring backup data using own systems, financial entities shall use ICT systems that are physically and logically segregated from the source ICT system.” Those systems are securely protected from unauthorised access or ICT corruption and allow timely restoration	BP-05 and BP-07, for financial entities: restoring on systems segregated from the source
DORA — Delegated Regulation (EU) 2024/1774	Article 7(2) — financial entities “identify and implement controls to protect cryptographic keys through their whole lifecycle against loss, unauthorised access, disclosure, and modification”, designed on the results of the approved data classification and the ICT risk assessment	BP-11, for financial entities: protecting cryptographic keys through their lifecycle
DORA — Delegated Regulation (EU) 2024/1774	Article 7(3) — “Financial entities shall develop and implement methods to replace the cryptographic keys in the case of loss, or where those keys are compromised or damaged.”	BP-11, for financial entities: replacing keys that are lost or compromised
GDPR — Regulation (EU) 2016/679	Article 32(1)(a) — the security measures of the controller and the processor include, as appropriate, “the pseudonymisation and encryption of personal data”	BP-10: encryption of personal data held in backups
GDPR — Regulation (EU) 2016/679	Article 32(1)(b) — the security measures include, as appropriate, “the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services”	BP-01 to BP-09 and BP-12: confidentiality, integrity and availability of the backup systems
NCSC (UK) guidance	Blog post “Offline backups in an online world” (13 August 2019) — the offline rule, “At any given time, are one or more backups offline?”, because “With at least one backup offline at any given time, an incident cannot affect all of your backups simultaneously”; the “3-2-1” rule, “at least 3 copies, on 2 devices, and 1 offsite”, which “does not require any backup location to be offline”; and the regular rule, that backups should be “regularly tested to check they work as expected”	BP-06 and BP-08: at least one backup offline at any given time
NIST SP 800-209 (October 2020)	Section 4.7, IS-SS-R2 — storage systems that hold cyber-attack recovery copies “should be managed from designated management systems, which are separated from the production environment”; “It should not be possible to access such management systems with regular credentials (including production and regular backup).”	BP-01 and BP-05: recovery copies managed from systems that regular credentials cannot reach
NIST SP 800-209 (October 2020)	Section 4.7, IS-SS-R3 — for sensitive information, cyber-attack recovery copies and their systems should not be accessible to regular IT staff; and “Access rights to long-term archives backups should be separate from those used to perform other storage administration duties”, using “separate user IDs, accounts, and credentials”	BP-02 and BP-04: access rights to recovery copies kept separate from other storage administration
NIST SP 800-209 (October 2020)	Section 4.7, IS-SS-R7 — “Cyber-attack recovery copies should not be mounted, exported, or mapped to a host or application, and they should be restored (pushed) onto an isolated staging (or air-gapped) environment rather than directly onto the target hosts or applications.”	BP-07: recovery copies not mounted on a host or application
NIST SP 800-209 (October 2020)	Section 4.7, IS-SS-R10 — “Consider the use of immutable storage, which could help further isolate and protect recovery data (e.g., retention locking, vault locking, immutability policies).”	BP-08 and BP-09: immutable storage and retention locks

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774; Regulation (EU) 2016/679 (GDPR); NIST SP 800-209 (October 2020); NCSC (UK) blog post "Offline backups in an online world" (2019)

Implementing Regulation (EU) 2024/2690 binds only the providers its Article 1 names: DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers. Other organisations may use its Annex as good practice.

Regulation (EU) 2022/2554 binds financial entities. Articles 5 to 15, including 11 and 12, do not apply to the entities of its Article 16(1), which follow Article 16(1)(f) and Articles 39 and 40 of Delegated Regulation (EU) 2024/1774. Articles 7 and 8 of the Delegated Regulation are in its Title II, for the other financial entities.

NIST SP 800-209 and the NCSC post are guidance. They bind nobody, and an organisation may weigh each recommendation against its own risks.

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. They do not say that meeting one meets any other framework's requirement.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.