+Backup Policy

1. Overview

Backup Policy

Define backup policies aimed at ensuring minimum downtime, limited disruption, and loss, and put in place restoration and recovery procedures. Specify the scope of the data subject to backups and the minimum frequency of backups, based on the criticality or confidentiality of data. Determine a Recovery Time Objective (RTO) and a Recovery Point Objective (RPO) based on data criticality and overall impact on market efficiency to ensure that service levels are met in extreme scenarios.

1.1 References

1.2 Identified Requirements

1.2 Related Regulation

2. Identified Requirements

Requirements

3. Related Regulations

Regulations
DORA DORA Ch. II Sec. II Art. 12 1.

1.   For the purpose of ensuring the restoration of ICT systems and data with minimum downtime, limited disruption and loss, as part of their ICT risk management framework, financial entities shall develop and document:

  • (a) backup policies and procedures specifying the scope of the data that is subject to the backup and the minimum frequency of the backup, based on the criticality of information or the confidentiality level of the data;
  • (b) restoration and recovery procedures and methods.
DORA DORA Ch. II Sec. II Art. 12 2.
2.   Financial entities shall set up backup systems that can be activated in accordance with the backup policies and procedures, as well as restoration and recovery procedures and methods. The activation of backup systems shall not jeopardise the security of the network and information systems or the availability, authenticity, integrity or confidentiality of data. Testing of the backup procedures and restoration and recovery procedures and methods shall be undertaken periodically.
DORA DORA Ch. II Sec. II Art. 12 3.

3.   When restoring backup data using own systems, financial entities shall use ICT systems that are physically and logically segregated from the source ICT system. The ICT systems shall be securely protected from any unauthorised access or ICT corruption and allow for the timely restoration of services making use of data and system backups as necessary.

For central counterparties, the recovery plans shall enable the recovery of all transactions at the time of disruption to allow the central counterparty to continue to operate with certainty and to complete settlement on the scheduled date.

Data reporting service providers shall additionally maintain adequate resources and have back-up and restoration facilities in place in order to offer and maintain their services at all times.
DORA DORA Ch. II Sec. II Art. 12 6.
6.   In determining the recovery time and recovery point objectives for each function, financial entities shall take into account whether it is a critical or important function and the potential overall impact on market efficiency. Such time objectives shall ensure that, in extreme scenarios, the agreed service levels are met.
DORA DORA Ch. II Sec. II Art. 12 7.
7.   When recovering from an ICT-related incident, financial entities shall perform necessary checks, including any multiple checks and reconciliations, in order to ensure that the highest level of data integrity is maintained. These checks shall also be performed when reconstructing data from external stakeholders, in order to ensure that all data is consistent between systems.
Impressum