All 93 controls · Technological controls
Control 8.13
Information backup
What ISO/IEC 27002:2022 control 8.13 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Backups of information, software and systems are to be kept and tested regularly as the agreed topic-specific backup policy requires. Purpose: be able to get data and systems back after they are lost. Guidance: set a backup policy reflecting retention and security requirements, provide backup facilities sufficient to recover all essential information and software after an incident, failure or media loss, and develop and implement plans for backing up information, software and systems. A backup plan should consider: accurate, complete records of backup copies and documented restore procedures; the extent (full or differential) and frequency of backups, set by business requirements such as the recovery point objective (5.30), the security needs of the information and how critical it is to continued operation; storage in a safe remote location far enough away to escape a disaster at the main site; physical and environmental protection of backups consistent with the main site (Clause 7, 8.1); regular testing of backup media so they can be relied on, restoring to a test system rather than over the originals in case the backup or restore fails and destroys data; encrypting backups according to risk, for example where confidentiality matters; and making sure accidental data loss is noticed before the backup runs. Operational procedures monitor backup runs and deal with failed scheduled backups so backups are complete. Backup arrangements for individual systems and services are tested regularly against incident response and continuity objectives, together with the restore procedures and the recovery time the continuity plan requires; for critical systems, backups cover all system information, applications and data needed to rebuild the whole system after a disaster. For cloud services, back up the organization's own data, applications and systems held in the cloud environment and decide whether and how the provider's backup service meets requirements. Set retention periods for essential information including archive copies, and consider deleting information from backup media when retention expires (8.10), within the law. Other information: ISO/IEC 27040 covers storage security and retention.
Purpose in the standard’s terms, in our words: Makes it possible to recover lost data or systems.
Attribute values in one line: Corrective; Integrity, Availability; Recover; Continuity; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Corrective |
|---|---|
| Information security properties | IntegrityAvailability |
| Cybersecurity concepts | Recover |
| Operational capabilities | Continuity |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
- Restore test records onto test systems, checked against the recovery time in the continuity plan
- Evidence of off-site or geographically separate backup storage with suitable physical protection
- Backup encryption configuration and key management where confidentiality requires it
- Assessment of cloud provider backup capabilities, or independent backups of cloud-hosted data and configurations
Where audits commonly find gaps
- Backups run but full system restores have never been tested
- Backups are stored in the same site or cloud region as production
- Cloud SaaS data is assumed to be backed up by the provider
- Backup failures are logged but not followed up, leaving gaps
What ISO/IEC 27028 changes for this control
It carries a single control type, corrective, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (12.3.1) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.