Backup and Recovery Management

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.9.3 Backup and Recovery Management], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

Backup and recovery procedures that include backup targets, cycles, methods, steps, etc. must be established and implemented so that timely recovery is possible when an information system is damaged due to disasters/calamities, faults, security incidents, etc..

• Establishment of criteria for selecting backup targets
• Designation of backup personnel and the responsible person
• Definition of backup cycles and retention periods for each backup target
• Backup methods and procedures : use of a backup system, manual methods, etc.
• Management of backup media (e.g., labeling, storage location, access control, etc.)
• Backup recovery procedures : for key information systems, from an IT disaster recovery perspective, regular recovery tests must be performed to check the completeness, accuracy, etc. of backup information
• Management of the backup management ledger, etc.

※ Main backup targets (examples) (selected in consideration of the importance of the target information and information systems)

• Important information (personal information, confidential information, etc.)
• Important databases
• Various logs (information system audit logs, event logs, security system event logs, etc.)
• Configuration files, etc.

Recovery tests must be conducted regularly to verify the completeness and accuracy of backed-up information and the adequacy of recovery procedures.

• Recovery test plan (recovery test cycle and timing, responsible person, method, etc.)
• Establishment of recovery test scenarios
• Conduct of recovery tests and reporting of results
• Establishment and implementation of an improvement plan when problems are found in recovery test results

For backup media on which important information is stored, the backup media must be dispersed to a physically separated location so as to cope with disasters and calamities.

• Backup media on which important information is stored are dispersed and stored at a location physically distant from where the operating information system or the backup system is located, and the dispersal history is managed with a management ledger
  • Dispersal date (removal, receipt, etc.)
  • Dispersed backup media and content of backup information
• Periodically check whether dispersal is being carried out appropriately
• Prepare the following security measures for the dispersal location
  • Measures against natural disasters such as fire and flood (e.g., fire-resistant safe, flame-retardant treatment, etc.)
  • Access control for the dispersal location and media, etc.