S 6.37 Documenting data backup procedures

Initiation responsibility: IT Security Management

Implementation responsibility: Person-in-charge of data backup

A data backup policy must determine how the generated data backups should be documented. Documentation is necessary for orderly and efficient data backup. The following items are to be documented for each generated data backup:

• Date of data backup

• Extent of data backup (files/directories)

• Data media on which the operational data are stored

• Data media on which the backup data are stored

• Data backup hardware and software (with version number)

• Data backup parameters (type of data backup etc.)

The procedure required for data restoration must also be documented. The necessary hardware and software must be described, as must the required parameters and the procedure to be followed for data reconstruction.

Additional controls:

• Are data backups documented to the required degree?

• Can data restoration be performed with the help of the documentation even by a person other than the one who backed up the data?