4.2 Backup and redundancy management

Requirement

The relevant entities shall maintain backup copies of data and provide sufficient available resources, including facilities, network and information systems and staff, to ensure an appropriate level of redundancy.

Guidance

• Consider whether to invest in own redundancy or to engage third parties, for example cloud providers, to provide such redundancy, in alignment with the BIA (Annex to the regulation, point 4.1.3).

Examples of evidence

• Backups are physically separated from the systems that generated them.
• If the service is offered by a third party, SLAs.

Requirement

Based on the results of the risk assessment carried out pursuant to point 2.1 and the business continuity plan, the relevant entities shall lay down backup plans which include the following: (a) recovery times; (b) assurance that backup copies are complete and accurate, including configuration data and data stored in cloud computing service environment; (c) storing backup copies (online or offline) in a safe location or locations, which are not in the same network as the system and are at sufficient distance to escape any damage from a disaster at the main site; (d) appropriate physical and logical access controls to backup copies, in accordance with the asset classification level; (e) restoring data from backup copies; (f) retention periods based on business and regulatory requirements.

Guidance

• Recovery times should not exceed the recovery objectives referred to in 4.1.2 (f) of the Annex to the regulation.
• Concerning retention periods consider what is referred to in point 3.2.5 of the Annex to the regulation.
• If an entity engages third parties to ensure an appropriate level of redundancy, it should be clearly decided whether it is the entity's responsibility to compile the backup plans or if the third parties have any involvement in the process.

Examples of evidence

• Backup plans.
• Logs from backup software that show regular backups are being performed.
• Backups physically separated and with an appropriate level of protection, including encryption.
• Logs or reports confirming that one copy of the backup is stored off-site, such as in a cloud storage service or a remote data centre.
• Configuration settings of backup software to verify that it is set up to create copies of data and store them on different media.
• Clear and concise restoration procedures that cover all relevant systems and services.
• If applicable, settings of the cloud storage service to ensure it is configured to receive and store backup copies.

Requirement

The relevant entities shall perform regular integrity checks on the backup copies.

Guidance

• Check the integrity of the backup copies. An indicative, non-exhaustive list of good practices is the following:
  • use checksums or hashing algorithms to verify that the data in your backups matches the original data (section 9.2);
  • implement automated scripts to run these checks regularly, reducing the risk of human error;
  • schedule regular tests to restore data from backups to ensure they are complete, functional and validated by business users to confirm the accuracy and usability of the restored data;
  • test various recovery scenarios, including full system restores and individual file recoveries, to ensure all aspects of your backup system are reliable; and
  • consider using cloud storage solutions for off-site backups, which often include built-in integrity checks and redundancy.

Examples of evidence

• Logs or reports showing that checksum or hashing algorithms are used.
• Settings in backup software or scripts that specify the use of checksums or hashing algorithms.
• Records of regular tests in which data is restored from backups.
• Evidence of tests of different recovery scenarios, including full system restores and individual file recoveries.
• Logs or reports from actual incidents in which recovery procedures were implemented (Annex to the regulation, points 3.2 and 3.5).
• If the service is offered by a third party, SLAs.

Requirement

Based on the results of the risk assessment carried out pursuant to point 2.1 and the business continuity plan, the relevant entities shall ensure sufficient availability of resources by at least partial redundancy of the following: (a) network and information systems; (b) assets, including facilities, equipment and supplies; (c) personnel with the necessary responsibility, authority and competence; (d) appropriate communication channels.

Guidance

• Define minimum resources needed to ensure at least partial redundancy for each of points (a), (b), (c) and (d). These may include the following:
  • network and information systems: one or more of the following (indicative, non-exhaustive list):
    • multiple internet service providers,
    • load balancing,
    • mirrored servers,
    • virtualisation,
    • redundant array of independent disks;
  • assets: one or more of the following (indicative, non-exhaustive list):
    • shared workspaces,
    • backup locations,
    • spare equipment,
    • multiple suppliers for the same categories of products;
  • personnel: one or more of the following (indicative, non-exhaustive list):
    • job rotation,
    • backup assignments,
    • emergency drills;
  • multiple communication platforms, for example social media, messaging apps and email; and
  • multiple methods to power a site, either through multiple electrical providers or with a combination of electrical providers and backup mechanisms, such as generators.

Examples of evidence

• One or more of the above mechanisms are in place.

Requirement

Where appropriate, the relevant entities shall ensure that monitoring and adjustment of resources, including facilities, systems and personnel, is duly informed by backup and redundancy requirements.

Guidance

• Decisions about resource allocation and adjustments should be guided by the need for backups and redundancy. To this end, the entity might consider one or more of the following (indicative, non-exhaustive list):
  • prioritisation of resources based on the results of the risk analysis;
  • partial redundancy;
  • diverse backup locations; and
  • continuous monitoring of the resources where redundancy is necessary.

Examples of evidence

• Evidence of elements referred to in point 4.2.4 of the Annex to the regulation.
• Evidence from periodic simulations and awareness raising activities to assess the readiness of personnel and the adequacy of the procedures.

Requirement

The relevant entities shall carry out regular testing of the recovery of backup copies and redundancies to ensure that, in recovery conditions, they can be relied upon and cover the copies, processes and knowledge to perform an effective recovery. The relevant entities shall document the results of the tests and, where needed, take corrective action.

Guidance

• Tailor the frequency of the backup checks to the data criticality based on the risk assessment (section 2.1). As an example:
  • Data with high criticality might be checked on a weekly basis.
  • Data with moderate and low criticality might be checked on a monthly basis.
  • Significant changes should be checked immediately after the change.
• Make sure that the issues and lessons learnt from exercises are addressed by the responsible people and that the relevant processes and systems are updated accordingly.
• Involve suppliers and other third parties, such as business partners or customers in tests.

Examples of evidence

• Reports/logs of regular testing of backup status, processes and procedures.
• Test programme for backup plans, including types of contingencies, frequency, roles and responsibilities, templates and procedures for conducting tests, and templates for post-test reports.
• Reports of past tests of backup and contingency plans.
• Reports about tests and drills showing the execution of the plans, including evidence that recovery times were met and lessons learnt from the tests.
• Issues and lessons learnt from past tests addressed by the responsible people.
• Updated test plans, review comments and/or change logs.
• Input from suppliers and other third parties involved about how to improve test scenarios.

Tips: guidance

• Protect backup and restoration hardware and software.
• Ensure that encrypted backups remain accessible by securely maintaining the associated encryption keys. Encryption keys should be stored separately from the backup data to prevent unauthorized access and ensure recoverability.
• Before systems or configurations are restored, a ‘patient zero (37)’ may need to be identified so that the restoration does not restore any vulnerabilities or infections that have sometimes been cleaned up.
• Consider the 3-2-1 backup rule:
  • keep three copies of the data (the original plus two backups),
  • on two different types of storage media (e.g. hard drives, cloud storage),
  • with one copy stored offsite.
• Ensure the integrity of backups, that is, prevent any modification or deletion, such as ransomware encryption or tampering, within a defined retention period. Ways to ensure this include (indicative, non-exhaustive list):
  • malware and ransomware scanning of backups before backups are stored;
  • use of immutable backups;
  • offline storage of backups.
• Integrate business continuity and disaster recovery plans with incident response (Annex to the regulation, point 3.5) and crisis management processes (Annex to the regulation, point 4.3).
• When available cloud services:
  • backups will be replicated across multiple availability zones or stored in an alternate region to ensure resilience against zone-level failures;
  • will be configured with cross-zone replication to minimise downtime;
  • all backup data will be encrypted at rest using cloud-native key management systems and encrypted during transfer using TLS 1.2+;
  • regular backup testing will be performed to validate cross-zone recovery capabilities.

Tips: examples of evidence

• Measures in place to protect backup and restoration hardware and software, for example physical access controls, surveillance systems, encryption, integrity checks and failover mechanisms.
• Review of the backup plan which mentions the 3-2-1 rule.
• Logs from backup software that show regular backups are being performed.
• Configuration settings of backup software to verify that it is set up to create three copies of data and store them on different media.
• If applicable, settings of the cloud storage service ensuring it is configured to receive and store backup copies.