S 6.13 Development of a data backup plan

Initiation responsibility: Head of IT Section, IT Security Management

Implementation responsibility: Administrator; staff responsible for the individual IT applications

The data backup plan must enable an expert third person to obtain within reasonable time, and to install, the entire software required for the restart of an IT procedure (operating system software, application software) and the associated data.

A data backup policy must provide information on:

• the storage location of the data during normal operation (disk-memory space allocation table);

• stock of backup data (inventory);

• the time of data saving;

• nature and extent of data backup (logical/physical; partial/full);

• the procedure used for data saving and for reconstruction of backup data;

• the location where the media are kept (indication of any access means required).

The systematic compilation of a data-backup policy as the basis for a data-backup plan is described in Chapter 3.4.

Additional controls:

• Are data backup measures carried out in accordance with the data backup policy?

• Has the possibility to obtain, without delay, the required data media from external data backup stocks been ascertained during emergency preparedness exercises?

• How up-to-date is the existing data backup policy?