Checklist · Operations

Backup and restore test

A backup you have not restored is a hope. Use this to run, record and learn from a restore test.

Owner: Service owner and operationsTime: 2 hours, each quarterISO 27001 A.8.13ISO 27001 A.8.14ISO 27001 A.5.30

0 of 16

Plan

Pick the system, the recovery point (RPO) and recovery time (RTO) objectives, and the person who decides if the test passed.
Choose a backup from the middle of the retention window, not only yesterday's.
Restore into an isolated environment, never over production.
Confirm who has permission to read the backup and the encryption key.

Run

Record the start time and every step, including the ones that needed a workaround.
Restore the data, then restore or rebuild the application on top of it.
Verify integrity: row counts, checksums, a known record, and that the application starts and a user can log in.
Record the end time and compare it with the RTO; compare the age of the data with the RPO.

Protect the backups

Backups are encrypted and stored in a separate account or location from the source.
At least one copy is immutable or offline, so ransomware that owns the source cannot delete it.
Backup credentials differ from production credentials; backup deletion needs a second approval.
Failed or skipped jobs alert someone, and alerts are acted on within a day.

Close out

Result recorded as pass, partial or fail with times, evidence and the tester's name.
Gaps (missing documentation, slow steps, missing keys) ticketed with owners and dates.
The runbook is updated with what the test taught you.
The test environment and restored data are deleted.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed. ISO references show where a list helps, not that it satisfies a control.

See these as tasks in Cisodium All checklists

Готови ли сте да надминете
класическия GRC?

14 дни безплатен пробен период. Без карта. В облак или локално.

Заявете демо Говорете с продажбите →

Backup and restore test

Plan

Run

Protect the backups

Close out

Готови ли сте да надминетекласическия GRC?

Готови ли сте да надминете
класическия GRC?