ISO 27001 Backup Procedures: Protecting Against Data Loss
ISO 27001 backup procedures are a mandatory requirement under Annex A control 8.13 (information backup). Any organisation certified to ISO 27001 must implement a documented backup policy that covers frequency, storage, rotation, encryption, testing and restoration. Without proper backup procedures, a ransomware attack, hardware failure or human error can destroy critical business data and invalidate your ISMS certification. This article provides a complete guide to meeting Annex A.12.3 (now A.8.13 in the 2022 update) requirements, with practical advice on backup types, scheduling, storage, testing and cloud backup.
Published: July 2026 | Last updated: July 2026 | Author: Bitrixme Compliance Team
Annex A.12.3 (A.8.13) Requirements: What the Standard Says
ISO 27001:2022 Annex A control 8.13 requires organisations to maintain backup copies of information, software and system images in accordance with an agreed backup policy. The control is a preventive measure against data loss, designed to support business continuity and disaster recovery arrangements. Organisations must define and document their backup requirements, including the scope of data to be backed up, frequency of backups, retention periods and restoration procedures.
The backup policy must be approved by management and reviewed at planned intervals. A certification auditor will check that your backup policy exists, that it is being followed, that backups are tested regularly and that restoration times meet the organisation’s business requirements. The standard does not prescribe specific technologies, so your choices must be justified by a risk assessment.
| Annex A Control | Requirement | Auditor Evidence |
|---|---|---|
| A.8.13 (Information backup) | Backup copies maintained per agreed policy | Backup policy document, backup logs, restoration test records |
| A.8.13 (Retention) | Backup retention periods defined and enforced | Retention schedule, backup catalogue, disposal records |
| A.8.13 (Testing) | Backups tested regularly to verify reliability | Test reports with restoration outcomes and timelines |
| A.8.13 (Offsite storage) | Backup stored separately from primary site | Offsite storage agreement, location register, transfer logs |
Types of Backup: Full, Incremental and Differential
Three primary backup methods are used in ISO 27001 environments. Each has distinct advantages and trade-offs in terms of storage space, backup window and recovery time. The choice affects your RPO (Recovery Point Objective) and RTO (Recovery Time Objective), both of which must be documented in your business continuity plan.
| Backup Type | What It Captures | Storage Usage | Backup Speed | Restore Speed |
|---|---|---|---|---|
| Full backup | All selected data, regardless of change status | Highest | Slowest | Fastest |
| Incremental backup | Only data changed since the last backup (any type) | Lowest | Fastest | Slowest (requires full + all increments) |
| Differential backup | Only data changed since the last full backup | Medium | Medium | Medium (requires full + latest differential) |
Most ISO 27001-compliant organisations use a combination: a weekly full backup, daily incremental backups and a monthly differential backup for longer retention. The specific schedule must be based on your recovery objectives and documented in the backup policy. The risk assessment should identify which systems require the fastest recovery and your backup strategy should prioritise those systems accordingly.
Backup Schedule and Retention Policy
Annex A.8.13 requires an agreed backup policy, and the schedule is a core element. The schedule must detail what is backed up, how often, the retention period for each backup set and who is responsible. Retention periods should be based on legal, regulatory and operational requirements, not on storage capacity.
For most organisations, the following minimum schedule is appropriate:
| Backup Type | Frequency | Retention Period | Example |
|---|---|---|---|
| Daily (incremental) | Every 24 hours | 7 – 30 days | Nightly incremental, keep 14 days |
| Weekly (full) | Once per week | 4 – 12 weeks | Sunday full backup, keep 8 weeks |
| Monthly (full) | Once per month | 6 – 12 months | First of month full backup, keep 12 months |
| Yearly (full) | Annually | 3 – 7 years | Year-end archive, keep 5 years for legal hold |
Your backup schedule must be formally documented and approved. Any deviation from the schedule (for example, skipped backups due to maintenance windows) must be recorded with a reason and a catch-up plan. The certification auditor will examine backup logs for gaps and unexcused omissions.
Storage and Rotation: The 3-2-1 Rule
ISO 27001 does not explicitly mandate the 3-2-1 backup rule, but it is widely recognised as a best practice that satisfies the standard’s intent. The rule states: at least three copies of data, on at least two different types of storage media, with at least one copy stored offsite. The principle ensures that a single failure or disaster cannot destroy all copies of your data.
Backup rotation schemes determine which media are reused and when. Common rotations include Grandfather-Father-Son (GFS) and Tower of Hanoi. The GFS scheme aligns naturally with the daily-weekly-monthly schedule described above and is the simplest to document for audit purposes. Whichever scheme you choose, the rotation must be documented and the rotation records must be verifiable.
Encryption of Backup Data
Backup data must be protected against unauthorised access both during transit and at rest. ISO 27001 control A.8.24 (use of cryptography) and A.8.13 together require that backup media containing sensitive information be encrypted. The encryption key management process must be included in the backup policy, because losing the encryption key can be as damaging as losing the data itself.
Best practice for backup encryption includes:
- Encrypting all backup data at rest using AES-256 or equivalent strong encryption
- Encrypting backup data in transit using TLS 1.2 or higher when transferring over a network
- Storing encryption keys separately from backup data, preferably in a hardware security module (HSM) or key management service (KMS)
- Documenting key recovery procedures to prevent permanent data loss
- Testing decryption as part of regular restoration tests
Cloud backup providers typically offer server-side encryption. However, for ISO 27001 compliance, organisations should enable client-side encryption where possible or ensure the provider’s encryption controls are covered by a signed Data Processing Agreement (DPA) and the provider’s own ISO 27001 certification.
Testing Backups: Restoration Drills and Verification
Annex A.8.13 explicitly requires that backups are tested regularly. An untested backup is not a backup; it is hope. Testing verifies both the integrity of the backup data and the restoration procedure, including the time required to restore each system. The testing schedule should be documented in the backup policy and records of each test must be retained.
| Test Type | Frequency | What to Verify | Documentation |
|---|---|---|---|
| Quick verification | Daily or weekly | Backup completed successfully, file integrity check | Automated backup log review |
| Partial restoration test | Monthly | Single file or folder restoration from backup | Test report with screen captures |
| Full restoration test | Quarterly | Complete system restoration to a test environment | Full test report with time measurements |
| Disaster recovery drill | Annually | Full site recovery from backup at alternate location | DR exercise report with lessons learned |
Each restoration test must document what was restored, the time taken, any errors encountered and the corrective actions taken. If a restoration test fails, it is a nonconformity that must be raised through your corrective action process. The certification auditor will ask for test records spanning the full audit period and may challenge long gaps between tests.
Offsite Storage and Geographic Separation
Offsite storage of backup data is a requirement of Annex A.8.13. The purpose is to ensure that a physical disaster at the primary site – fire, flood, theft or physical tampering – does not destroy both the live data and the backup copies. Offsite storage can be physical (tape or hard drive in a separate building or commercial storage facility) or logical (cloud storage in a different geographic region).
For GCC organisations, offsite storage considerations include data residency requirements. Bahrain’s PDPL, Saudi Arabia’s PDPL and the UAE’s data protection law all impose restrictions on transferring personal data outside national borders. Your backup provider and the location of backup storage must comply with the data protection regulations of each country where you operate. A backup stored in a jurisdiction without adequate data protection may itself be a compliance breach.
Cloud Backup: Ensuring ISO 27001 Compliance
Cloud backup is increasingly common in ISO 27001 environments, but it introduces additional compliance considerations. The cloud backup provider must be subject to a formal supplier security assessment, as required by Annex A.5.19 (supplier relationships). The assessment should verify the provider’s own security certifications, data centre locations, encryption standards, access controls and incident response procedures.
Key requirements for ISO 27001-compliant cloud backup include:
- A signed Data Processing Agreement (DPA) that specifies data handling, retention and deletion terms
- Evidence of the provider’s ISO 27001 certification or equivalent independent audit report
- Provider transparency on data centre locations, with contractual restrictions on cross-border storage that conflicts with local data protection laws
- Multi-region or multi-availability-zone backup replication for redundancy
- Regular testing of cloud backup restoration, including full system recovery from cloud storage
The cloud backup architecture must be documented in your ISMS, including network topology, encryption keys, access control lists and recovery procedures. The provider relationship must be included in the supplier register and reviewed periodically as part of the ISMS management review process.
Common Backup Nonconformities in ISO 27001 Audits
Understanding where audits typically uncover backup failures helps you prepare. The most common ISO 27001 nonconformities related to backup include:
- No documented backup policy. The organisation performs backups but has no approved, documented policy defining what, when and how.
- No restoration test records. Backups run successfully but nobody has ever verified that data can actually be restored.
- Encryption key management gaps. Backup data is encrypted but the encryption keys are stored on the same system, defeating the purpose.
- Inconsistent backup schedules. Logs show gaps without documented justification or catch-up procedures.
- Missing offsite storage. All backups are stored in the same physical location as the primary data, violating Annex A.8.13 requirements.
- Cloud provider without DPA. Backup data is stored with a cloud provider without a signed data processing agreement or supplier assessment.
FAQ
Does ISO 27001 require daily backups?
No. ISO 27001 does not prescribe a specific frequency. Annex A.8.13 requires that backups are performed in accordance with an agreed policy. Your risk assessment and recovery objectives determine the appropriate frequency. Daily incremental backups are common but not mandatory.
Is the 3-2-1 backup rule mandatory for ISO 27001?
The 3-2-1 rule is not explicitly mandated by ISO 27001, but it is recognised as best practice that satisfies the intent of Annex A.8.13. The standard requires at least one backup copy stored separately from the primary site, which the 3-2-1 rule addresses.
Can I use cloud backup for ISO 27001 compliance?
Yes, provided the cloud provider meets the standard’s supplier security requirements (Annex A.5.19) and data protection obligations. You need a signed DPA, evidence of the provider’s security certifications and documented restoration testing.
How often should I test backup restoration?
Full restoration tests should be conducted at least quarterly, with partial restoration tests monthly. The frequency must be documented in your backup policy. Annual testing is the absolute minimum and may be challenged by an auditor.
What happens if a restoration test fails?
A failed restoration test constitutes a nonconformity under ISO 27001. You must raise a corrective action, investigate the root cause, fix the issue and re-test. The incident must be recorded in your nonconformity and corrective action logs.
Do I need to encrypt backup tapes and drives?
Yes. Annex A.8.24 requires the use of cryptography to protect sensitive information. Backup media containing confidential or personal data must be encrypted at rest and in transit. Encryption keys must be managed separately from backup data.
Need help building ISO 27001-compliant backup procedures? Contact our ISMS implementation team for a gap analysis and backup policy review, or message us on WhatsApp.
