Backups are not about convenience. They are about survival when something goes wrong. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses take comfort in a green dashboard checkmark showing a “successful backup,” only to discover during a real ransomware attack or server crash that the files were corrupt, incomplete, or impossible to restore. Backups are not proven when they run. They are proven when they restore.
ISO 27001:2022 includes Annex A 8.13 to ensure you treat backup and recovery as a core resilience mechanism. This control replaces the former 2013 standard (12.3.1) and updates guidance to cover modern cloud environments, immutable storage, ransomware protection, and strict restoration testing.
Quick Summary: What ISO 27001 Annex A 8.13 Requires
At a practical level, Annex A 8.13 is about recoverability and resilience, not just copying files. It expects a topic-specific, risk-based backup strategy that guarantees you can restore critical systems within agreed business timescales. Here is what you need to do in plain English:
- Define a Topic-Specific Backup Policy: Document what data, software, and configurations are backed up, how often, and for how long.
- Establish Business RTOs and RPOs: Set clear Recovery Time Objectives (how long you can be down) and Recovery Point Objectives (how much data loss you can accept).
- Separate Backups From Live Production: Isolate backup files physically or logically to prevent ransomware from wiping backups alongside live servers.
- Encrypt Backup Data: Protect backup files at rest and in transit with strong encryption to prevent data leaks (Annex A 8.24).
- Monitor Backup Jobs Daily: Set up automated alerts to catch failed or partial backup jobs immediately.
- Test Restores Regularly: Conduct routine, documented restoration tests to prove your backups actually work when needed.
Why Untested Backups Are a Critical Business Hazard
Data loss happens through hardware failure, human error, ransomware, software corruption, or third-party cloud outages. If your backup strategy relies on assumptions rather than tested controls, your business is exposed to catastrophic downtime.
Failing to establish proper backup controls creates severe business risks:
- Total Business Disruption: Inability to restore critical systems following a ransomware attack, leaving operations paralyzed for weeks.
- Ransomware Propagation: Connected or unencrypted backups getting encrypted or deleted by malware alongside production environments.
- Silent Backup Failure: Backup jobs failing silently for months due to storage limits or permissions errors without anyone noticing.
- Regulatory and Legal Breaches: Violating contractual SLAs or data protection laws (like GDPR) by permanently losing customer records.
My 11 Step Plan to Implement Annex A 8.13 Fast
You do not need to overcomplicate your backup architecture to satisfy an ISO 27001 auditor. Here is my pragmatic, 11-step plan to establish an audit-ready, resilient backup framework.
1. Publish a Topic-Specific Backup Policy
Document an explicit backup policy aligned with your information classification scheme (Annex A 5.12) and business risk profile. Ensure your policy covers:
- Scope of systems, data, cloud platforms, and configurations included in backups.
- Backup schedules (e.g., daily incremental, weekly full) and retention rules.
- Assigned roles and responsibilities for backup execution, monitoring, and testing.
2. Map Everything That Requires Backup
Do not limit backups to local file servers. Conduct a complete inventory of data assets requiring protection:
- On-premises databases, virtual machine images, and server configurations.
- Cloud platforms (e.g., Microsoft 365, Google Workspace, AWS/Azure storage buckets).
- Third-party SaaS applications, source code repositories, and network switch configs.
3. Define Business RTO and RPO Metrics
Align backup technical schedules directly with agreed business recovery expectations rather than arbitrary IT choices:
- Recovery Time Objective (RTO): Define the maximum acceptable downtime duration for each system.
- Recovery Point Objective (RPO): Define the maximum acceptable data loss timeframe (e.g., 4 hours, 24 hours).
- Ensure technical backup frequencies and replication speeds support these business targets.
4. Enforce Physical and Logical Isolation (Air-Gapping)
Modern ransomware actively targets backup repositories first to prevent recovery. Keep backups isolated from production:
- Maintain offline (air-gapped) or immutable (WORM—Write Once, Read Many) backup storage copies.
- Host backup repositories on dedicated subnets or separate cloud accounts with unique credentials.
- Enforce strict access controls so production admin credentials cannot delete backup repositories.
5. Encrypt Backup Data at Rest and in Transit
Backups contain your complete corporate history. Treat backup storage with the same security as live data:
- Encrypt backup files in transit across networks using TLS and at rest using strong AES-256 encryption (Annex A 8.24).
- Protect backup encryption keys separately from the backup media itself.
- Ensure offsite or cloud backup targets enforce strict access controls and multi-factor authentication.
6. Validate Backup Jobs Pre- and Post-Execution
ISO 27001:2022 emphasizes data integrity checks around backup jobs. Build validation checks into your routines:
- Verify system integrity and file consistency prior to running backup schedules.
- Check automated completion logs to confirm backup jobs finish without errors or skipped files.
- Investigate and resolve partial failures or incomplete backup runs immediately.
7. Conduct Routine, Documented Restoration Tests
A backup is an unverified assumption until you prove it restores cleanly. Establish a formal testing schedule:
- Conduct monthly file-level restoration tests and quarterly full-system disaster recovery drills.
- Measure actual restore times against agreed RTO and RPO benchmarks.
- Document test dates, restored file samples, outcomes, and corrective actions taken for audit evidence.
8. Monitor Backup Operations Continuously
Silent backup failures are lethal. Ensure IT leads have continuous visibility over backup health:
- Configure real-time email or dashboard alerts for failed, delayed, or interrupted backup jobs.
- Assign named staff responsible for checking daily backup logs and clearing errors (Annex A 8.16).
- Include backup health metrics in monthly management reviews.
9. Manage Backup Retention Deliberately
Storing backups indefinitely increases storage costs, legal discovery risks, and privacy compliance exposure:
- Align retention schedules strictly with legal, regulatory, and contractual commitments.
- Implement automated deletion routines to purge expired backup snapshots cleanly (Annex A 8.10).
- Ensure customer deletion requests (GDPR right to erasure) are managed appropriately across backup archives.
10. Secure Physical and Cloud Storage Locations
Ensure backup storage media and cloud targets maintain physical and environmental resilience:
- Store physical backup media (tapes/drives) in fireproof, climate-controlled, secure offsite locations.
- Verify that cloud backup providers enforce high availability, redundancy, and physical security standards.
- Restrict physical and logical access to backup media strictly to vetted personnel.
11. Align Backup Controls with Business Continuity
Connect your backup procedures directly to your broader Incident Management and Disaster Recovery playbooks:
- Ensure step-by-step restoration guides are accessible offline during major system outages.
- Integrate backup restoration procedures into your formal ransomware response playbooks.
- Train incident response leads on execution priorities during a full system rebuild.
Common Implementation Pitfalls and How to Fix Them
When preparing clients for ISO 27001 audits, I frequently spot the same backup mistakes. Here are the main traps and how to solve them:
- Problem: Assuming Cloud SaaS Data Is Automatically Backed Up by the Provider
Ninja Solution: Implement dedicated third-party backup tools for Microsoft 365, Google Workspace, and SaaS databases. - Problem: Backups Stored on the Same Local Drive or Network as Live Systems
Ninja Solution: Isolate backups on separate network domains or immutable cloud storage buckets. - Problem: Backup Failure Notifications Going to an Unmonitored IT Inbox
Ninja Solution: Route backup failure alerts directly into your primary IT ticketing system with mandatory daily triage. - Problem: Claiming Backups Are Tested Without Any Documented Proof
Ninja Solution: Maintain a simple test log capturing dates, restored file names, recovery speeds, and engineer sign-offs.
The ISO 27001 Ninja Bottom Line
ISO 27001 Annex A 8.13 is about guaranteeing your business can recover when prevention fails. Preventive security controls attempt to stop security incidents, but robust, tested backups ensure your business survives them.
By defining clear recovery objectives, separating backups from production networks, encrypting data, monitoring daily jobs, and proving restoration through routine testing, you build a resilient safety net that protects your business and satisfies your ISO 27001 auditor with complete confidence.