4.2.6 The relevant entities shall carry out regular testing of the recovery of backup copies and …

Requirement

The relevant entities shall carry out regular testing of the recovery of backup copies and redundancies to ensure that, in recovery conditions, they can be relied upon and cover the copies, processes and knowledge to perform an effective recovery. The relevant entities shall document the results of the tests and, where needed, take corrective action.

Guidance

• Tailor the frequency of the backup checks to the data criticality based on the risk assessment (section 2.1). As an example:
  • Data with high criticality might be checked on a weekly basis.
  • Data with moderate and low criticality might be checked on a monthly basis.
  • Significant changes should be checked immediately after the change.
• Make sure that the issues and lessons learnt from exercises are addressed by the responsible people and that the relevant processes and systems are updated accordingly.
• Involve suppliers and other third parties, such as business partners or customers in tests.

Examples of evidence

• Reports/logs of regular testing of backup status, processes and procedures.
• Test programme for backup plans, including types of contingencies, frequency, roles and responsibilities, templates and procedures for conducting tests, and templates for post-test reports.
• Reports of past tests of backup and contingency plans.
• Reports about tests and drills showing the execution of the plans, including evidence that recovery times were met and lessons learnt from the tests.
• Issues and lessons learnt from past tests addressed by the responsible people.
• Updated test plans, review comments and/or change logs.
• Input from suppliers and other third parties involved about how to improve test scenarios.

Tips: guidance

• Protect backup and restoration hardware and software.
• Ensure that encrypted backups remain accessible by securely maintaining the associated encryption keys. Encryption keys should be stored separately from the backup data to prevent unauthorized access and ensure recoverability.
• Before systems or configurations are restored, a ‘patient zero (37)’ may need to be identified so that the restoration does not restore any vulnerabilities or infections that have sometimes been cleaned up.
• Consider the 3-2-1 backup rule:
  • keep three copies of the data (the original plus two backups),
  • on two different types of storage media (e.g. hard drives, cloud storage),
  • with one copy stored offsite.
• Ensure the integrity of backups, that is, prevent any modification or deletion, such as ransomware encryption or tampering, within a defined retention period. Ways to ensure this include (indicative, non-exhaustive list):
  • malware and ransomware scanning of backups before backups are stored;
  • use of immutable backups;
  • offline storage of backups.
• Integrate business continuity and disaster recovery plans with incident response (Annex to the regulation, point 3.5) and crisis management processes (Annex to the regulation, point 4.3).
• When available cloud services:
  • backups will be replicated across multiple availability zones or stored in an alternate region to ensure resilience against zone-level failures;
  • will be configured with cross-zone replication to minimise downtime;
  • all backup data will be encrypted at rest using cloud-native key management systems and encrypted during transfer using TLS 1.2+;
  • regular backup testing will be performed to validate cross-zone recovery capabilities.

Tips: examples of evidence

• Measures in place to protect backup and restoration hardware and software, for example physical access controls, surveillance systems, encryption, integrity checks and failover mechanisms.
• Review of the backup plan which mentions the 3-2-1 rule.
• Logs from backup software that show regular backups are being performed.
• Configuration settings of backup software to verify that it is set up to create three copies of data and store them on different media.
• If applicable, settings of the cloud storage service ensuring it is configured to receive and store backup copies.

1. Pārskats

1.1 Atsauces

1.2 Identificētās prasības

1.3 Saistītie tiesību akti

2. Identificētās prasības

3. Saistītie tiesību akti

Saistītie uzdevumi

• ENISA -