Key takeaways
- Take backups and test that they can be restored.
- Backups are your last line of defence against ransomware, mistakes and failures.
- Start here: define what to back up, how often and how long to keep it.
Purpose
Take backups and test that they can be restored.
Requirement
Requirement summaryBackup copies of information, software and systems shall be maintained and regularly tested in accordance with the agreed topic-specific policy on backup.
Why it matters
Backups are your last line of defence against ransomware, mistakes and failures.
How to implement
- Define what to back up, how often and how long to keep it.
- Store backups separately, ideally with an immutable or offline copy.
- Encrypt and access-control backups.
- Test restores regularly and record results.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.13. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your backup policy: what is backed up, how often, how long it is kept and how backups are protected.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.13 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Backup logs showing backups run successfully.
- Restore test records showing backups actually work.
- Settings showing backups are protected and stored separately from live systems.
- Records of failed backups and how they were fixed.
Things you should be able to show or explain
- Be able to explain what happens when a backup fails.
How much to show: Backup logs for a few dates plus the last restore test.
Common mistakes
- Restores never tested.
- Failed backups not followed up.
- Never testing restores.
- Backups reachable with the same credentials attackers would steal.
- Tip: Follow the 3-2-1 rule and keep one copy offline/immutable.
Policies & documents to have
- Operations Security Policy
FAQ
Is A.8.13 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.13?
Be ready to explain how the control works in your organisation and to provide things like: Your backup policy: what is backed up, how often, how long it is kept and how backups are protected…