CON.3 Backup Concept

The IT Operation Department MUST ascertain the framework conditions for backups of each IT system and the applications executed on them. For this purpose, the application Process Owners MUST define their requirements for data protection. At minimum, the IT Operation Department MUST agree the following framework conditions with the Process Owners:

• Data to be backed up
• Storage space
• Change volumes
• Changing times
• Availability requirements
• Confidentiality requirements
• Integrity requirements
• Legal requirements
• Requirements for deleting and destroying data
• Responsibilities for backing up data

The parameters MUST be recorded in a clear and appropriate manner. New requirements MUST be considered promptly.

The IT Operation Department MUST determine the procedure for how data is to be backed up.

A backup procedure MUST define the type, frequency, and times of backups. This MUST be based on the parameters that have been determined and involve the Process Owners of the respective applications. The storage media to be used and the manner in which they are to be transported and stored MUST also be defined. Backups MUST always be stored on separate storage media. Backup storage media requiring particular protection SHOULD only be connected to the respective organisation's network or the source system during backup and restoration procedures.

For virtual environments and storage systems, checks SHOULD be carried out on whether the IT system at hand can be additionally backed up by snapshot mechanisms in order to create several quickly recoverable intermediate versions between the complete backups.

The IT Operation Department MUST create backup plans based on the defined backup procedure at hand. These MUST define the minimum backup requirements to be met. At minimum, the backup plans MUST contain short descriptions of the following:

• The IT systems and data to be included in each backup
• The order in which IT systems and applications should be restored
• How the backups can be created and restored
• How long backups should be stored
• How backups can be protected from unauthorised access and overwriting
• The parameters to be selected
• The hardware and software to be used

Regular data backups MUST be made in line with the applicable backup plans. All employees MUST be informed of their organisation's backup regulations. They MUST also be informed of the tasks they are to perform in the creation of backups.

Backup storage media MUST be kept physically separate from the backed-up IT systems. They SHOULD be stored in a different fire zone. The storage location SHOULD be air-conditioned in such a way that the storage media can be stored for the amount of time specified in the backup concept at hand.

Created backups MUST be suitably protected against unauthorised access. In particular, it MUST be ensured that backups cannot be overwritten intentionally or unintentionally. IT systems used for data protection SHOULD only allow write access to backup storage media for authorised backup or administrative activities. Alternatively, backup media SHOULD only be connected to the corresponding IT systems for authorised backups or authorised administrative activities.

Tests MUST be performed regularly to determine whether the backup process is working as desired, and especially whether the backed-up data can also be restored without any problems within an appropriate period of time.

An organisation SHOULD prepare a backup concept that includes at least the following points:

• Definitions of essential aspects of backups (e.g. different types of backup procedures)
• Threat landscape
• Factors influencing each IT system or group of IT systems
• Backup plans for each IT system or group of IT systems
• Relevant findings from business continuity management, in particular the recovery point objective (RPO) for each IT system or group of IT systems.

The IT Operation Department SHOULD coordinate the backup concept with the Process Owners responsible for the applications affected. If a central backup system is used, it SHOULD be noted that there may be a higher need for protection due to the concentration of data. Backups SHOULD be carried out regularly in line with the backup concept.

The backup concept itself SHOULD also be included in backups. The technical information contained in the backup concept to restore systems and backups (backup plans) SHOULD be backed up in such a way that it will be available even if the backup systems themselves fail.

Employees SHOULD be informed about the parts of the backup concept that concerns them. The proper implementation of the backup concept SHOULD be checked regularly.

Before procuring a backup system, the IT Operation Department SHOULD create a requirements list to evaluate the products available on the market. The backup systems an organisation purchases SHOULD meet the requirements of its backup concept.

If online storage is to be used for backups, the following points SHOULD be contractually regulated at minimum:

• How the corresponding contract is formulated
• Where the data will be stored
• Service level agreements (SLAs), particularly in terms of availability
• Suitable authentication methods for access
• Encryption of data stored online
• Transport encryption

In addition, the backup system and network connection in question SHOULD offer performance that will not exceed the permissible backup or restore times.

The IT Operation Department SHOULD encrypt all backups to ensure the confidentiality of backed-up data. It SHOULD be ensured that encrypted data can be restored even after extended periods of time. The cryptographic keys used SHOULD be protected by a separate backup.