Backup and Recovery Policy
Backup and recovery of critical business information
Purpose
Ensure that data, systems and software configurations are protected against loss, disruption or security incidents, guaranteeing the integrity and availability of critical information.
Scope
Applies to all the organization's systems, data and software configurations, including servers, workstations, databases and cloud services, and to the staff, vendors and consultants who interact with them.
Objectives
- Back up data, systems and configurations regularly and securely.
- Provide fast recovery in the event of data loss or corruption.
- Periodically validate the effectiveness of backups.
- Regularly review and update the associated cybersecurity requirements.
Standards
Data Backup
- Identify critical data with the Head of IT.
- Store backups in physically separate locations (DR Site).
- Determine backup frequency according to criticality: daily, weekly or monthly.
- Use full, incremental or differential backups as needed.
- Store on secure, encrypted and protected media, including the cloud.
- Retain backups for at least 35 days or longer depending on criticality.
- Verify backups at least twice a year and perform periodic recovery tests.
Data Recovery
- Document backup and recovery procedures (backup types, frequency, owners, locations and recovery techniques).
- Perform restore tests at least quarterly.
- Report results to the Head of IT and Information Security.
Secure Storage
- Protect backups with physical and electronic controls (locks, ACS, biometrics).
- Keep access logs for at least 30 days.
- Implement environmental security: fire detection and suppression, electrical protection, CCTV.
Backup Testing
- Define the scope, develop disaster scenarios, run tests and analyze results.
- Update procedures based on findings and document lessons learned.
Storage Management
- Transfer data between media according to cost and accessibility.
- Ensure critical backups are kept on fast, reliable devices.
Business Continuity and Recovery
- Maintain a documented and tested BCDRP, including:
- Identification of risks and critical functions.
- Emergency response team.
- Backup procedures, alternate sites and communication protocols.
- Regular testing and updates based on lessons learned.
Data Retention
- Corporate data: 1 year.
- Customer data: according to regulatory requirements.
- Employment data: 1 year from termination.
Monitoring and Review
- Review the policy at least annually or after significant changes in IT or security.
- Management and Information Security oversee the program, ensuring alignment with the Information Security Management System and applicable regulations.