+Data Protection and Recovery - Concept

Data Protection and Recovery - Concept

Policies and instructions for data backup and recovery are documented, communicated and provided in accordance with SP-01 regarding the following aspects.
• The extent and frequency of data backups and the duration of data retention are consistent with the contractual agreements with the cloud customers and the Cloud Service Provider's operational continuity requirements for Recovery Time Objective (RTO) and Recovery Point Objective (RPO);
• Data is backed up in encrypted, stateofthe-art form;
• Access to the backed-up data and the execution of restores is performed only by authorised persons; and
• Tests of recovery procedures (cf. OPS-08).
Additonal Criteria-
Supplementary Information - About the CriteriaThe data backup concept specifies which type of data backup is to be carried out (e.g. type, manner, duration) and specifies which data must also be backed up in special cases (e.g. pure use of compute nodes without data storage). When backing up data, a distinction must be made between backups and snapshots of virtual machines. Snapshots do not replace backups, but can be part of the backup strategy to achieve Recovery Point Objectives (RPO) if they are additionally stored outside the original data location. The business requirements of the Cloud Service Provider for the scope, frequency and duration of the data backup result from the business impact analysis (cf. BCM-03) for development and operational processes of the cloud service. If different data backup and recovery procedures exist for data under the responsibility of the cloud customer and the Cloud Service Provider, both variants must be included in a test according to this criteria catalogue. For procedures to secure the data of the Cloud Service Provider, only the adequacy and implementation of the controls must be proven, but not their effectiveness. For procedures to secure the data of cloud customers, proof of effectiveness must also be provided.

1. Pregled

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani predpisi

2. Ugotovljene zahteve

Zahteve

3. Povezani predpisi

Predpisi