Policy template

Backup & Recovery Policy template

This policy exists to ensure information and systems can be restored within agreed timeframes after loss, corruption or disruption. It applies to business data, system configurations and cloud services that support company activities.

Create this policy

What the policy contains

Backup
Restore testing
Retention

Who is responsible

IT Manager
System owners
Information Security Manager

What you decide

Backup frequency of critical dataHourly · Daily · Weekly
Recovery point objective (hours)
Recovery time objective (hours)
Restore testsMonthly · Quarterly · Every 6 months · Yearly
Daily backups kept for (days)

References covered

ISO/IEC 27001 Annex A: control 8.13
ISO/IEC 27001 Annex A: control 8.14
ISO/IEC 27001 Annex A: control 5.29
ISO/IEC 27001 Annex A: control 5.30
GDPR: Art. 32(1)(c) ability to restore availability and access
NIS2: Art. 21(2)(c) business continuity, backup management and disaster recovery

Other policy templates

Incident Management & Response Policy
Change Management Policy
IT Operations Policy
Asset Management Policy
Supplier Security Policy
Data Protection (Privacy) Policy