This guidance explains in plain terms what is backed up, how backups are protected and tested, and how data is restored when it is needed.

Effective Guidance Documents

This guidance document is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Guidance number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested guidance documents. No junk, jargon or unnecessary content. Simple and usable guidance documents developed over 25 years through practical use in the real world.

Further Reading

Further guidance on data backup and recovery:

• Data Backup and Electronic Information
• Backup, Business Continuity and ICT Recovery
• Information Security Incidents and Ransomware
• Information Security knowledge base

How to Download

These files are included in the alphaZ subscription. The guidance is also included in the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.

Need Help Implementing?

If you'd like hands-on help setting up your backup arrangements and information assets register, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Data Backup Guidance

A general guidance document on data backup, for employees and anyone responsible for company systems and information. It explains what a backup is, how information assets are identified for backup, the requirements for storing and protecting backups, off-site and cloud providers, testing, and restoring data.

Topics Covered

• What a backup is - a copy stored in a separate location, used to restore information that is lost, corrupted, deleted or attacked
• What is backed up - all important and critical information assets, electronic, paper or physical, listed on the information assets register
• Backup requirements - how often and how much is backed up based on importance and risk, with documented and reviewed backup processes
• Off-site and cloud backup - backup providers covered by a data transfer and processing agreement, with physical access controls at least as strong as the original systems
• Testing backups - testing at planned intervals that backup media are reliable and the information is complete and can be restored
• Restoring data - using backups in business continuity, setting retention periods by risk and legal and contractual requirements, and limiting recovery to authorised personnel

Who Is It For?

Everyone who creates or holds company information, and the people authorised to run backups and restore data.

Included in the ISO 27001 and ISO 22301 Toolkits

This guidance is supplied with the TT-8-02 Data Backup training talk, which is part of the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.

Using the Guidance

Issue it to staff with responsibility for systems and information, go through it with the matching training talk, and keep it as a reference when backup arrangements are reviewed. Record who has received it, for example on the training matrix.

Protecting the Backups Themselves

Backup media are kept in suitable environmental conditions, protected from unauthorised changes and protected to the level of the most sensitive information they hold. Copies of operating systems are stored away from the live software, off-site locations have physical access controls at least as strong as the originals, and cloud or off-site providers are covered by a data transfer and processing agreement.

Adapting the Guidance

Edit the guidance to match your own arrangements - your information assets register, your off-site or cloud backup providers, how often each system is backed up, how long backups are kept and who is authorised to restore data.

Related Documents

Other documents that work alongside this guidance:

• PP-8-01 Data Backup Policy Procedure
• PP-8-100 Information Security Policy Procedure
• F-IMS25 Information Assets Register
• F-Q95 Disaster Recovery Plan Form
• GG-1-05 Business Continuity
• GG-8-01 Information Security General