4.2.3 The relevant entities shall perform regular integrity checks on the backup copies.

Requirement

The relevant entities shall perform regular integrity checks on the backup copies.

Guidance

• Check the integrity of the backup copies. An indicative, non-exhaustive list of good practices is the following:
  • use checksums or hashing algorithms to verify that the data in your backups matches the original data (section 9.2);
  • implement automated scripts to run these checks regularly, reducing the risk of human error;
  • schedule regular tests to restore data from backups to ensure they are complete, functional and validated by business users to confirm the accuracy and usability of the restored data;
  • test various recovery scenarios, including full system restores and individual file recoveries, to ensure all aspects of your backup system are reliable; and
  • consider using cloud storage solutions for off-site backups, which often include built-in integrity checks and redundancy.

Examples of evidence

• Logs or reports showing that checksum or hashing algorithms are used.
• Settings in backup software or scripts that specify the use of checksums or hashing algorithms.
• Records of regular tests in which data is restored from backups.
• Evidence of tests of different recovery scenarios, including full system restores and individual file recoveries.
• Logs or reports from actual incidents in which recovery procedures were implemented (Annex to the regulation, points 3.2 and 3.5).
• If the service is offered by a third party, SLAs.

1. Prezentare generală

1.1 Referințe

1.2 Cerințe identificate

1.3 Reglementări asociate

2. Cerințe identificate

3. Reglementări asociate

Tichete legate

• ENISA -