Compliance Framework Alignment
ISO/IEC 27001:2022 — Annex A 8.13 (Information backup) ISO/IEC 27002:2022 — Control 8.13 (implementation guidance) SOC 2 (AICPA TSC) — Availability A1.2 (data backup & recovery infrastructure); A1.3 (recovery testing) PCI DSS v4.0.1 — Requirement 12.10 (incident response, incl. data-backup processes) CERT-In Directions, 2022 & DPDP Act, 2023 (India) — breach reporting where backups are affected This Policy is the "topic-specific policy on backup" required by ISO/IEC 27001:2022 Annex A 8.13, and evidences the data-backup, recovery-infrastructure and recovery-testing controls assessed under SOC 2 Availability criteria A1.2 and A1.3. It also supports PCI DSS v4.0.1 Requirement 12.10, whose incident-response plan must address data-backup processes. Certification / attestation requires operating evidence (backup logs, restore-test records, retention reports) — not the policy alone.
ACME TECHNOLOGIES PVT LTD INFORMATION BACKUP POLICY Aligned with ISO 27001:2022, SOC 2 & PCI DSS v4.0.1
Effective Date [Effective Date]
Review Date [Review Date]
Framework Alignment ISO 27001:2022, SOC 2 & PCI DSS v4.0.1
RTO / RPO Targets RTO 4h · RPO 1h
Backup Owner Vikram Patel
Escalation backups@company.com 1. Purpose and Scope
This Information Backup Policy ("Policy") establishes how Acme Technologies Pvt Ltd creates, protects, stores, retains, and tests backup copies of information, software, and systems so that data can be reliably restored following accidental deletion, corruption, hardware failure, cyber-attack (including ransomware), or disaster. It applies to all production systems, databases, application code and configuration, virtual machines, SaaS data, cardholder-data environment (CDE) components where applicable, and any information asset classified Confidential or Restricted. It applies to all employees, contractors, and third-party service providers who operate or manage backups on the Company's behalf. This Policy is the topic-specific backup policy required by ISO/IEC 27001:2022 Annex A 8.13.
2. Backup Scope and Inventory
A documented inventory of systems and datasets in scope for backup shall be maintained and reviewed at least annually. In scope: (a) production databases and transaction logs; (b) application source code, infrastructure-as-code, and configuration; (c) virtual machine / server images and container registries; (d) file shares and document repositories holding Confidential or Restricted data; (e) SaaS platforms (e.g. email, CRM, code hosting) whose native retention alone is insufficient; (f) security and audit logs; (g) cryptographic key material and secrets (backed up separately, under stricter controls). Systems that hold no data of business or regulatory value may be excluded, provided the exclusion is documented and approved. New systems must be added to the backup scope before entering production.
3. Backup Frequency and Scheduling
Backups shall be scheduled to meet the recovery objectives in Clause 6: (a) full backups are taken weekly; (b) incremental / differential backups are taken daily; (c) database transaction logs are backed up frequently enough that the Recovery Point Objective (RPO) of 1 hour(s) is not exceeded. Backup jobs shall run automatically on a defined schedule. Every backup job must produce a success/failure result that is monitored; failed or missed jobs must generate an alert to backups@company.com and be remediated before the next scheduled run.
4. The 3-2-1 Rule and Media Diversity
The Company applies the 3-2-1 backup rule as a minimum baseline: at least THREE copies of data are maintained (the production copy plus at least two backups), stored on at least TWO different media / storage types (e.g. primary storage plus object storage or immutable cloud repository), with at least ONE copy kept off-site in a geographically separate location. This is extended to the 3-2-1-1-0 model: at least ONE copy is immutable or air-gapped (Clause 9), and recovery is validated to ZERO errors through the restore testing in Clause 7. No single failure, site outage, or attack should be able to destroy all copies simultaneously.
5. Encryption and Access Control for Backups
All backup data shall be encrypted at rest using AES-256 (or equivalent) and encrypted in transit using TLS 1.2 or higher. Encryption keys shall be managed under the Company's key-management standard, rotated regularly, and stored separately from the backup data they protect. Access to backup systems, media, and restore functions shall follow least privilege and require multi-factor authentication (MFA); backup administration consoles shall be isolated from the general production network. Backup catalogues and restore actions shall be logged and reviewed. Where cardholder data is in scope, backups of the CDE inherit the same protection and access controls as the primary environment (PCI DSS).
6. RTO / RPO Alignment
Backup frequency, media, and retention are driven by the Company's recovery objectives, defined per system in the Business Impact Assessment: the target Recovery Time Objective (RTO) is 4 hour(s) and the target Recovery Point Objective (RPO) is 1 hour(s) for critical systems. The RPO dictates minimum backup frequency (data loss must not exceed the RPO), and the RTO dictates the recovery architecture and restore method. RTO/RPO targets shall be reviewed against actual measured restore times from the tests in Clause 7, and the backup design adjusted whenever a test shows objectives cannot be met.
7. Restore and Recovery Testing
Backups are only useful if they can be restored. Restore / recovery tests shall be performed quarterly for critical systems (and at least annually for all in-scope systems), using an isolated environment where practical to avoid impacting production. Each test shall: (a) restore representative data or a full system from backup; (b) verify integrity and completeness of the restored data; (c) confirm the system is functional and, where relevant, bootable; (d) measure actual recovery time and recovery point against the RTO/RPO in Clause 6; (e) test recovery of at least one immutable / off-site copy periodically. Test results, including any failures and corrective actions, shall be recorded and retained as audit evidence for ISO 27001 A.8.13, SOC 2 A1.3, and PCI DSS.
8. Geographic Separation and Off-site Storage
At least one backup copy shall be stored in a geographically separate location — Hyderabad (secondary cloud region) — sufficiently distant from primary systems that a single physical event (fire, flood, power, or regional outage) cannot destroy both primary data and its off-site backup. Where cloud storage is used, the off-site copy shall reside in a different region (and, where required, a different availability zone) from production. Cross-region replication and off-site transfers shall themselves be encrypted in transit and monitored for completion.
9. Immutability and Ransomware Protection
At least one backup copy shall be immutable — written once and non-modifiable, non-deletable, and non-encryptable for its retention period using Write-Once-Read-Many (WORM) / object-lock controls, or held on an air-gapped medium disconnected from the network. Immutable copies protect against ransomware and malicious or accidental deletion, including by privileged administrators. Immutability retention shall be at least equal to the standard retention in Clause 10, and the ability to restore from the immutable copy shall be validated as part of Clause 7 testing.
10. Retention and Disposal
Standard operational backups shall be retained for 35 days, providing a rolling recovery window. Long-term / archival backups required for legal, regulatory, tax, or contractual reasons shall be retained for 7 year(s), or longer where a specific law requires it. Retention schedules shall be documented per dataset and driven by the Business Impact Assessment and applicable regulation. Backups that have exceeded their retention period shall be securely and irreversibly destroyed, and media reused or decommissioned only after secure erasure or cryptographic destruction of keys.
11. Backup Failure Handling and Incident Response
Backup failures, missed jobs, and integrity or restore-test failures shall be treated as availability incidents: logged, alerted to backups@company.com , root-caused, and remediated within the recovery window. Backup and recovery form part of the Company's incident-response and business-continuity capability; where a security incident (including ransomware) affects backups or the cardholder-data environment, it shall be handled under the incident-response plan required by PCI DSS v4.0.1 Requirement 12.10, which is reviewed and tested at least annually. Where a data breach affects backed-up personal data, reporting obligations under the CERT-In Directions (6-hour reporting) and the DPDP Act, 2023 apply.
12. Roles, Responsibilities, and Monitoring
Vikram Patel is accountable for the operation, monitoring, and testing of backups under this Policy and is the escalation point at backups@company.com . Responsibilities include maintaining the backup inventory, verifying daily backup success, scheduling and recording restore tests, and reporting backup posture to management. Backup success rates, restore-test results, and any missed recovery objectives shall be reported to the CISO / management on a regular basis and used to drive continual improvement of the backup programme.
13. Policy Compliance and Review
Compliance with this Policy is mandatory for all Personnel and service providers involved in backup operations. Non-compliance may result in disciplinary action. This Policy shall be reviewed at least annually, and additionally after any significant backup failure, restore-test failure, major system change, or security incident affecting data availability. The next scheduled review date is [Review Date]. Approved changes shall be version-controlled and communicated to affected Personnel.
This Information Backup Policy has been approved by the management of Acme Technologies Pvt Ltd and is effective from [Effective Date].
CISO / CTO (Approver)
Approver (CISO / CTO name)
______________________
Backup / Recovery Owner
Vikram Patel
______________________