Information backup

Plain-language summary

Keeping copies of information, software and systems that you can actually restore — taken on a schedule set by how much you can afford to lose, stored where the incident cannot reach them, and tested so the first restore is not the one that matters.

What the clause is really asking

Backup is the control that decides whether a ransomware attack is a bad week or the end of the company, and it is audited accordingly. The control asks for a topic-specific backup policy that defines what is backed up (information, software and systems — including configurations, not just data), how often, how long copies are kept, where they are stored, how they are protected, and how and how often restores are tested. The frequency and retention come from the business: the recovery point objective (how much data loss is tolerable) and the recovery time objective (how fast it must be back) agreed with the process owners, not chosen by IT alone. Auditors now probe three habits: at least one copy that is offline, immutable or otherwise unreachable from a compromised network; encryption of backup media and transfers where confidentiality matters; and regular restore testing with the results recorded. For cloud services the control still applies — the provider's resilience is not your backup unless the contract says so and you have tested getting your data back.

What auditors look for

Auditors ask for the backup policy and then for last month's backup logs, looking for failed jobs and what was done about them. They ask which systems are not backed up and whether that was a decision or an oversight. The hard question is always the restore: when did you last restore something real, who did it, how long did it take, and where is the record? They check the offline or immutable copy exists and that the backup system's own credentials are separate from the domain that ransomware would compromise. They ask how backups of personal information are protected and when old backups are deleted — retention under POPIA cuts both ways.

Typical evidence

Backup policy with scope, frequency, retention, storage and testing rules; recovery point and recovery time objectives agreed per system; backup job logs and failure follow-up; restore test records with date, system, time taken and outcome; evidence of an offline, immutable or segregated copy; encryption settings for media and transfers; backup credential separation; deletion records for expired backups.

How to comply — recommendations

Agree the recovery objectives with the business first — a one-page table of systems, how much loss is acceptable and how fast each must return — and let that set frequency and retention. Follow the 3-2-1 habit: three copies, two media, one offline or immutable, with the backup system's credentials outside the main directory. Automate failure alerts to a person, not a mailbox nobody reads. Test a restore every quarter — a full server once a year, a handful of files and a database monthly — and record time taken against the objective. Include system configurations and cloud data in scope. Set a deletion rule for expired backups so personal information does not live forever in an archive.

Common nonconformities

No documented backup policy or recovery objectives; systems not backed up without a recorded decision; backup failures unnoticed or unresolved; no restore test ever performed, or none recorded; all copies online and reachable from the production network; backup media and transfers unencrypted; cloud data assumed to be the provider's problem; expired backups holding personal information never deleted.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.