4.2. Backup and redundancy management

(a)

recovery times;

(b)

assurance that backup copies are complete and accurate, including configuration data and data stored in cloud computing service environment;

(c)

storing backup copies (online or offline) in a safe location or locations, which are not in the same network as the system, and are at sufficient distance to escape any damage from a disaster at the main site;

(d)

appropriate physical and logical access controls to backup copies, in accordance with the asset classification level;

(e)

restoring data from backup copies;

(f)

retention periods based on business and regulatory requirements.

(a)

network and information systems;

(b)

assets, including facilities, equipment and supplies;

(c)

personnel with the necessary responsibility, authority and competence;

(d)

appropriate communication channels.