Auditing Backup and Recoverability: ISO 27001

Backup is one control, and recoverability is not. A.8.13 covers backup copies of information, software and systems. Whether the organisation could actually carry on is spread across A.8.14 redundancy, A.5.29 information security during disruption and A.5.30 ICT readiness for business continuity, and an audit that stops at the backup control has looked at one of the four.

The organisation in the worked finding on this page is invented, and so is the finding.

Four ISO 27001 backup and continuity controls, four different questions

The four are not alternatives. An organisation can hold complete backups, have no redundancy, have never considered how information stays protected while it is recovering, and have no idea what the business actually needs. Those are four findings against four controls, and telling them apart is part of what a lead auditor is examined on.

Start at the Statement of Applicability. All four are controls the organisation selected at Clause 6.1.3, and what it claims about each is your first criterion. A.8.14 and A.5.30 are the two most often marked applicable and implemented on the strength of equipment existing rather than of anything having been determined.

The ISO 27001 backup requirement that is easy to read past

A.8.13 says backup copies are to be maintained and regularly tested, in accordance with the agreed topic-specific policy on backup. Two limbs and a criterion, and the criterion is the organisation’s own policy. That has a consequence auditors sometimes miss in the other direction: the standard does not set a testing frequency, a retention period or a copy count. If the organisation’s policy sets them, they are the criteria. If its policy is silent, the gap is in the policy, and the finding is a different one.

So the first question in this area is not about backups at all. It is: what does your backup policy actually require, and when was it last agreed?

Where ISO 27001 recoverability lives, and the requirement people forget

A.5.30 is the control that connects all of this to the business, and it is the one most often absent. It asks for ICT readiness to be planned, implemented, maintained and tested against business continuity objectives and ICT continuity requirements. Those requirements are an input the organisation has to have determined, and most have not.

That produces a question worth asking early, because the answer shapes everything after it. How long can this organisation be without this system, and who decided that? An organisation that cannot answer has no criterion against which any of its arrangements can be evaluated — and neither have you. An organisation that can answer has just handed you the measure for everything else in the area.

A.5.29 is the quiet one. Its subject is information security during disruption, which is the period when controls are most likely to be suspended in the interests of getting going again. Ask what happens to access control, logging and approval during a recovery. The honest answer is often that nobody has thought about it, and that is the control’s whole point.

A worked ISO 27001 finding on Annex A.8.14

Netherfield Assurance operates a claims platform with nightly backups to a second site, a documented backup policy, and a schedule of restore exercises that runs and is recorded.

Read the control’s wording before you write anything here. A.8.14 asks for redundancy sufficient to meet availability requirements. Sufficiency is a comparison, and a comparison needs two terms. Where the second term does not exist, the finding is not that the redundancy is inadequate — you cannot know that — but that the organisation has no basis on which to say it is adequate. Those are different findings, and only one of them survives being argued with.

One discipline in writing any of these. Record what you were told where it establishes how far the failure reaches, and leave your own account of why it happened out of the box. The two managers’ divergent answers are recorded because they establish that the requirement is genuinely undetermined rather than merely undocumented. The finding stops there.

The audit trail for ISO 27001 backup and recoverability

Start with the policy, not the technology. What has the organisation agreed about backup: what is copied, how often, held how long, held where, and tested how? Those are the criteria, and without them everything you look at afterwards is an observation with nothing to measure it against.

Then ask what the business needs, and who decided it. This is the A.5.30 question and it is the most useful one on the page.

Then look at A.8.14 and A.5.30 together. Redundancy has to be sufficient to meet availability requirements, and ICT readiness has to be planned against continuity objectives and requirements. Both are comparisons, and both need a second term the organisation has determined. Where it has not, the finding is that sufficiency cannot be established rather than that anything is inadequate.

And ask about the disruption period itself. What controls apply while systems are being brought back, and who is allowed to bypass what.

Major or minor in an ISO 27001 backup finding

Major territory: no backup policy, so nothing has a criterion; a control marked implemented whose sufficiency has never been capable of being assessed; continuity arrangements that exist for the business and were never extended to ICT.

Minor territory: a system outside the schedule the policy sets; one exercise late in a programme that runs; a retention setting that does not match the policy on one system.

Escalation: arrangements across the whole area that were configured once and never revisited is a case about review rather than about backup, and belongs where the checking should have happened.

And the criteria are the standard and the organisation’s own requirements, not your view of good practice. Nowhere is that easier to forget than here, because most auditors have a number in their head for how often a restore should be exercised, and the standard has none.

Frequently asked questions about auditing backup and recoverability under ISO 27001

The other ISO 27001 control areas

auditing cloud services

auditing access control

auditing supplier and third-party security

auditing incident management

For the controls behind these areas, the four Annex A theme pages set out what each group requires: the A.5 organizational controls, the A.6 people controls, the A.7 physical controls, the A.8 technological controls.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.