Redundancy of information processing facilities

What the control asks

Information processing facilities are to be built with enough redundancy to satisfy availability requirements. Purpose: keep processing facilities operating without interruption. Guidance: identify availability requirements for business services and information systems and design and build a systems architecture with redundancy that meets them. Redundancy can mean duplicating facilities partly or completely, from spare components to two of everything. Plan and implement procedures for bringing redundant components and facilities into use, stating whether they are always active or activated automatically or manually in an emergency; redundant elements must be secured as strongly as the primary ones. Mechanisms should alert the organization to failures, allow the planned procedure to run and keep services available while facilities are repaired or replaced. Consider contracting several providers for network and critical processing services, internet access among them; redundant networks; mirrored systems in two data centres in different locations; physically redundant power supplies or sources; multiple parallel software instances with automatic load balancing within or across data centres; and duplicated components within systems (processors, disks, memory) or networks (firewalls, routers, switches). Where it applies, and ideally on live systems, test that failover between components works as intended. Other information: redundancy is closely linked to ICT readiness for continuity (5.30), especially where recovery times are short; copying data to duplicates can introduce integrity errors and weakly secured duplicates can compromise confidentiality, so both must be designed for; redundancy does not usually cure faults within an application; public cloud allows multiple live copies in several places, failing over and balancing load automatically, discussed in ISO/IEC TS 23167.

Purpose in the standard’s terms, in our words: Keeps information processing facilities running without interruption.

Attribute values in one line: Preventive; Availability; Protect; Continuity, Asset management; Protection, Resilience.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Documented availability requirements for business services and systems
• Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
• Procedures for activating redundant components, stating whether activation is automatic or manual
• Failover test records, preferably from production, showing failover worked as intended
• Monitoring and alerting configuration for component failures
• Evidence that redundant components carry the same security controls as primary ones

Where audits commonly find gaps

• Redundant components exist but failover has never been tested
• Both internet links run through the same physical route or provider
• The secondary site has weaker security controls than the primary
• Single points of failure remain in supporting components such as DNS or identity services

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (17.2.1) is kept in the register so an older audit file can still be traced. It serves more than one security domain, which is why a domain count taken by row understates the view.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.29 Information security during disruption
• 5.37 Documented operating procedures
• 7.13 Equipment maintenance

Read the five attributes All 93 controls