ISO 27001 Annex A 8.13 Backup and recovery procedures for data
What it says
Backup copies of information, software and systems shall be maintained and regularly tested in accordance with the agreed topic-specific policy on backup.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep and test backups of data and systems regularly as per backup policy.
This control is about making sure you have backup copies of your important data and systems, and also about testing these backups regularly. If you don't do this, you risk losing crucial information or systems, which can seriously disrupt your business operations.
Free. Save your status, tasks and notes.
Why it matters
Without regular, tested backups, data loss from corruption or deletion could halt operations for days, risking financial and reputational damage.
How to implement
The IT manager should create a backup plan.
This plan should include what needs to be backed up, how often backups are done, and where backups are stored, aligning with the business's recovery needs as outlined in ISO 27002:2022.
The operations team should select a secure location for storing backups.
Ensure the location is far enough from the main office to not be affected by the same disaster, as recommended by ISO 27002:2022 standards.
The IT staff should regularly test these backups.
They should simulate a recovery process onto a separate test system to ensure reliability, without affecting the current live data.
The security officer should ensure that all backups are encrypted.
This is crucial when handling sensitive information, adhering to ISO 27002 and OAIC guidelines to protect privacy and comply with the Privacy Act 1988.
The executive team should review the organisation's business continuity requirements.
They need to ensure that the backup strategy aligns with these requirements, referencing standards like CPS 234 to fulfil regulatory expectations.
Keep it running
Regularly test backups by restoring a sample to verify integrity, and confirm all critical systems and data sets are included in backup schedules.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The backup policy document.
Look at
Whether it includes details on backup frequency, storage locations, and security measures.
Good evidence
A comprehensive document that clearly aligns with business and regulatory needs.
- Check 2 of 5What an auditor asks for
Ask for
A demonstration of a backup recovery test.
Look at
How the test is conducted and whether it uses a separate test environment.
Good evidence
A successful demonstration with documentation showing the process and results.
- Check 3 of 5What an auditor asks for
Ask for
To see records of backup storage locations.
Look at
Their distance from the main office and security arrangements.
Good evidence
Secure, geographically separate sites that meet business continuity standards.
- Check 4 of 5What an auditor asks for
Ask for
About encryption measures for backups.
Look at
Whether sensitive data is appropriately encrypted.
Good evidence
Encryption technology being used that complies with current standards and regulations.
- Check 5 of 5What an auditor asks for
Ask for
Logs of backup operation and testing.
Look at
The frequency and results of tests and any noted issues.
Good evidence
Regular and successful tests recorded without significant issues, showing operational capability readiness.
Mappings
Closest match in ASD Essential Eight: E8-RB-ML1.2, Ensure backups are synchronised for restoration to a common point in time, which this control covers in full and more.
ASD Essential Eight: 6 mappings
This control is broader than E8-RB-ML1.2.
E8-RB-ML1.2 requires backups of data, applications and settings to be synchronised so restoration can occur to a common point in time. ISO/IEC 27001:2022 Annex A 8.13 is broader because it requires maintaining backup copies of information, software and systems and regularly testing them in line with a backup policy, without mandating synchronisation specifically. E8-RB-ML1.2 can be implemented as a specific design requirement within an Annex A 8.13-compliant backup program.
This control is broader than E8-RB-ML1.3.
E8-RB-ML1.3 requires backups of data, applications and settings to be retained securely and in a resilient manner. ISO/IEC 27001:2022 Annex A 8.13 requires maintaining backup copies and regularly testing them in line with an agreed backup policy, which includes but extends beyond secure/resilient retention into governance and testing. E8-RB-ML1.3 is one key outcome that would contribute to meeting Annex A 8.13, but Annex A 8.13 has broader procedural and testing expectations.
This control is broader than E8-RB-ML1.4.
E8-RB-ML1.4 mandates testing restoration from backups to a common point in time as part of disaster recovery exercises. Annex A 8.13, however, requires backups to be maintained and regularly tested per a policy, encompassing more than disaster recovery restoration testing.
This control is broader than E8-RB-ML1.6.
E8-RB-ML1.6 requires that unprivileged accounts are prevented from modifying and deleting backups. Annex A 8.13 requires organisations to maintain and regularly test backup copies in line with a backup policy, and integrity of backups is strengthened when unprivileged users cannot tamper with them. E8-RB-ML1.6 supports Annex A 8.13 by improving the trustworthiness of backups, but Annex A 8.13 is broader and covers backup processes and testing beyond access restrictions.
This control is broader than E8-RB-ML3.3.
Annex A 8.13 requires organisations to maintain backups and regularly test them so they are usable for recovery. E8-RB-ML3.3 hardens backup integrity by preventing backup administrator accounts from modifying or deleting backups during their retention period, reducing the risk that backups become unavailable or untrustworthy. This is a protective measure that strengthens Annex A 8.13 outcomes, but it is not the same requirement as maintaining and testing backups under a policy.
This control partially overlaps E8-RB-ML1.1.
Annex A 8.13 requires organisations to maintain backups and regularly test them under an agreed backup policy. E8-RB-ML1.1 specifies that backups are performed and retained in accordance with business criticality and business continuity requirements, which is a concrete driver for what the backup policy should mandate (frequency/retention). E8-RB-ML1.1 does not explicitly cover the 'regularly tested' requirement, and Annex A 8.13 is broader in that it also applies to software and systems and explicitly mandates testing.
ASD Information Security Manual: 12 mappings
This control is broader than ISM-1515.
ISM-1515 requires testing restoration of data, applications and settings from backups to a common point in time specifically during disaster recovery exercises. Annex A 8.13 requires backup copies to be maintained and regularly tested in line with the organisation's backup policy, covering broader backup testing expectations beyond disaster recovery exercising. ISM-1515 is a specific scenario and testing objective within the wider backup testing requirement of Annex A 8.13.
This control is broader than ISM-1705.
Annex A 8.13 requires backups to be maintained and regularly tested so they can be relied upon for recovery. ISM-1705 restricts privileged user accounts (excluding backup administrators) from accessing other users' backups, reducing the risk of unauthorised access or interference that could undermine backup trustworthiness. This complements Annex A 8.13 by improving backup confidentiality and integrity controls, but it does not itself require maintaining or testing backups.
This control is broader than ISM-1810.
ISM-1810 requires backups of data, applications and settings to be synchronised so restoration can occur to a common point in time. Annex A 8.13 covers maintaining backups and regularly testing them under an agreed backup policy, which can include (but is not limited to) synchronisation requirements. ISM-1810 is a specific backup design requirement (point-in-time consistency), whereas Annex A 8.13 is broader across backup governance, operation and testing.
This control is broader than ISM-1928.
ISM-1928 requires a specific set of backup protection measures for Microsoft identity infrastructure servers, including ASD-approved encryption, secure storage, and limiting access to backup administrator accounts. ISO/IEC 27001:2022 Annex A 8.13 requires maintaining and regularly testing backups in line with a policy, which encompasses defining protections such as encryption and access controls for backups. ISM-1928 is a prescriptive, high-risk-system-specific instantiation of the broader backup-and-recovery procedural requirements in Annex A 8.13.
- ISM-2151Technically enforced immutability protecting backups through their retention periodBroader than
This control is broader than ISM-2151.
ISM-2151 requires that stored backups are protected by technically enforced immutability for the full retention period. ISO/IEC 27001:2022 Annex A 8.13 requires maintaining backups and regularly testing them in accordance with a backup policy, covering the broader backup process lifecycle. ISM-2151 is a specific technical control that can be used to satisfy part of Annex A 8.13's protection expectations, but Annex A 8.13 also includes requirements (policy alignment and testing) not addressed by ISM-2151.
This control partially meets ISM-0042.
ISM-0042 requires organisations to develop, implement and maintain system administration procedures for effective ongoing system operations. Annex A 8.13 requires backup copies to be maintained and regularly tested in accordance with an agreed backup policy, which is typically implemented through operational administration runbooks and procedures. Annex A 8.13 is narrower and focused on backup and recovery activities, while ISM-0042 covers the broader administration operating model and procedure set across many operational practices.
This control partially meets ISM-1555.
ISM-1555 requires personnel to back up remaining data, applications, and settings before taking mobile devices overseas, as part of a broader pre-travel hardening process. Annex A 8.13 relates by requiring backup copies to be maintained and regularly tested in accordance with an agreed backup policy, which encompasses the act of performing backups that ISM-1555 calls for. ISM-1555 is narrower because it is travel-triggered and device-specific, whereas Annex A 8.13 covers ongoing backup governance and testing across systems.
This control partially overlaps ISM-0917.
ISM-0917 requires organisations to isolate malware-infected systems, scan potentially exposed media, attempt removal using antivirus, and restore or rebuild if removal is unreliable. Annex A 8.13 requires maintaining and testing backups so systems and data can be recovered. They overlap where ISM-0917 explicitly uses restoration from a known good backup as a remediation path, while Annex A 8.13 is broader backup governance and testing rather than malware-specific handling steps.
This control partially overlaps ISM-1511.
Annex A 8.13 requires backup copies of information, software and systems to be maintained and regularly tested in line with an agreed backup policy. ISM-1511 requires backups of data, applications and settings to be performed and retained based on business criticality and business continuity requirements, which overlaps with the 'maintained' and 'policy-driven' aspects of Annex A 8.13. ISM-1511 is more specific about aligning backup regimes to continuity needs, while Annex A 8.13 additionally (and explicitly) requires regular testing.
This control partially overlaps ISM-1547.
Annex A 8.13 requires backup copies of information, software and systems to be maintained and regularly tested in accordance with an agreed backup policy. ISM-1547 requires organisations to develop, implement and maintain data backup processes and supporting procedures, which directly contributes to the 'maintained' aspect of Annex A 8.13. ISM-1547 does not, on its face, require regular testing, so it is supportive and partially aligned rather than equivalent in scope.
This control partially overlaps ISM-1548.
ISM-1548 requires organisations to develop, implement and maintain data restoration processes and supporting procedures. Annex A 8.13 relates by requiring backup copies be maintained and regularly tested, which directly supports effective restoration and provides inputs and assurance for restoration procedures.
This control depends on ISM-1574.
ISM-1574 requires supplier contracts to document portable storage arrangements that enable backups and restoration/migration without losing data. Annex A 8.13 requires backup copies and regular testing in line with the organisation's backup policy, which provides the operational backup capability that ISM-1574 expects to be contractually supported by providers. Annex A 8.13 does not require supplier agreement clauses or portability/exit terms, but it strengthens the feasibility of meeting ISM-1574's backup and recoverability expectations.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-10.1Back up data, applications and settings on schedule to encrypted, resilient storageBroader than
This control is broader than IT.PRO-10.1.
IT.PRO-10.1 requires important data, applications and settings to be backed up on a defined schedule to secure, resilient storage protected by encryption and immutable, offline, logically isolated or equivalent controls. This is a specific implementation of the backup copies of information, software and systems that Annex A 8.13 requires to be maintained, with explicit expectations for how those copies are protected. Annex A 8.13 is broader, also requiring backups to be regularly tested and managed in accordance with an agreed topic-specific policy on backup.
- IT.PRO-10.3Regularly test backup and restoration procedures against defined recovery objectivesBroader than
This control is broader than IT.PRO-10.3.
IT.PRO-10.3 requires regular testing of backup and restoration procedures to confirm that backups are reliable and can meet defined recovery time and recovery point objectives. This directly implements the regular testing element of Annex A 8.13, using recovery objectives as explicit test criteria. Annex A 8.13 is broader, also requiring backup copies of information, software and systems to be maintained in line with an agreed topic-specific policy on backup.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.