Checklist · Operations

Backup and restore test

A backup you have not restored is a hope. Use this to run, record and learn from a restore test.

Owner: Service owner and operationsTime: 2 hours, each quarterISO 27001 A.8.13ISO 27001 A.8.14ISO 27001 A.5.30

0 of 16

Plan

Pick the system, the recovery point (RPO) and recovery time (RTO) objectives, and the person who decides if the test passed.
Choose a backup from the middle of the retention window, not only yesterday's.
Restore into an isolated environment, never over production.
Confirm who has permission to read the backup and the encryption key.

Run

Record the start time and every step, including the ones that needed a workaround.
Restore the data, then restore or rebuild the application on top of it.
Verify integrity: row counts, checksums, a known record, and that the application starts and a user can log in.
Record the end time and compare it with the RTO; compare the age of the data with the RPO.

Protect the backups

Backups are encrypted and stored in a separate account or location from the source.
At least one copy is immutable or offline, so ransomware that owns the source cannot delete it.
Backup credentials differ from production credentials; backup deletion needs a second approval.
Failed or skipped jobs alert someone, and alerts are acted on within a day.

Close out

Result recorded as pass, partial or fail with times, evidence and the tester's name.
Gaps (missing documentation, slow steps, missing keys) ticketed with owners and dates.
The runbook is updated with what the test taught you.
The test environment and restored data are deleted.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed. ISO references show where a list helps, not that it satisfies a control.

See these as tasks in Cisodium All checklists

Redo att gå
bortom klassisk GRC?

14 dagars gratis provperiod. Inget kort. Molnet eller on-premises.

Boka demo Prata med sälj →

Backup and restore test

Plan

Run

Protect the backups

Close out

Redo att gåbortom klassisk GRC?

Redo att gå
bortom klassisk GRC?