4.2.2 Based on the results of the risk assessment carried out pursuant to point 2.1 and the business …

Requirement

Based on the results of the risk assessment carried out pursuant to point 2.1 and the business continuity plan, the relevant entities shall lay down backup plans which include the following: (a) recovery times; (b) assurance that backup copies are complete and accurate, including configuration data and data stored in cloud computing service environment; (c) storing backup copies (online or offline) in a safe location or locations, which are not in the same network as the system and are at sufficient distance to escape any damage from a disaster at the main site; (d) appropriate physical and logical access controls to backup copies, in accordance with the asset classification level; (e) restoring data from backup copies; (f) retention periods based on business and regulatory requirements.

Guidance

• Recovery times should not exceed the recovery objectives referred to in 4.1.2 (f) of the Annex to the regulation.
• Concerning retention periods consider what is referred to in point 3.2.5 of the Annex to the regulation.
• If an entity engages third parties to ensure an appropriate level of redundancy, it should be clearly decided whether it is the entity's responsibility to compile the backup plans or if the third parties have any involvement in the process.

Examples of evidence

• Backup plans.
• Logs from backup software that show regular backups are being performed.
• Backups physically separated and with an appropriate level of protection, including encryption.
• Logs or reports confirming that one copy of the backup is stored off-site, such as in a cloud storage service or a remote data centre.
• Configuration settings of backup software to verify that it is set up to create copies of data and store them on different media.
• Clear and concise restoration procedures that cover all relevant systems and services.
• If applicable, settings of the cloud storage service to ensure it is configured to receive and store backup copies.

1. Pregled

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani predpisi

2. Ugotovljene zahteve

3. Povezani predpisi

Povezane zadeve

• ENISA -