Backup Management

Backup management is the comprehensive approach to designing, monitoring, and testing backup systems. Backups are not universal and must be paired with scenarios. For example, backups designed to expedite recovery in case of system failure may not be effective in remediating ransomware. Long-term retention is necessary to recover from persistent integrity threats.

Consider these scenarios when designing your backup management process:

Hardware Failure

Software Failure

Natural Disaster

Continuity Event

Malicious Actors

Viruses & Malware

Malicious Insiders

Programmatic Errors

Human Error

Category	Sub-Category	Name	Activity
Backup Management	Backup	Backup Configuration	[The organization] configures redundant systems or performs data backups [in accordance with the organization-defined frequency] to resume system operations in the event of a system failure.
Backup Management	Backup	Resilience Testing	[The organization] performs backup restoration or failover tests [in accordance with the organization-defined frequency] to confirm the reliability and integrity of system backups or recovery operations.
Backup Management	Backup	Alternate Storage / Offsite Strage	[The organization] backups are securely stored in an alternate location from source data. Note: this is often confused with “Cloud Backup” suggesting that alternate storage is in a cloud. Offsite Cloud Backup is not the same as “Cloud Backup" which represents the backup activities done within cloud providers to safeguard that data.
Backup Management	Backup	Cloud Backup Responsibility	[The organization] understands cloud provider backup and data retention responsibilities and has a written policy to cover any shortcomings.
Backup Management	Backup	Cloud Backup	[The organization] practices routine exports of data from SaaS providers and has restore plans for mission-critical or materially significant applications.
Backup Management	Backup	E-Mail and Online Storage	[The organization] uses a cloud backup provider to backup data stored within Microsoft 365 or Google Workspace. This specifically applies to Exchange Online, OneDrive, SharePoint, G-Mail, Google Drive.
Backup Management	Backup	Financial Data	[The organization] has a written policy and procedure for securing financial data outside of existing backup infrastructure; this program is focused predominantly on integrity and insider threat protections.