How to write a backup and recovery policy

Why backups are an audit focus

Anyone can claim they have backups. Auditors care that you defined what is backed up, how often, where copies live, and — critically — that you test restores. An untested backup is a hope, not a control.

What to include

Scope — which systems and data are in scope, by criticality.
Frequency — backup cadence tied to your Recovery Point Objective (RPO).
Retention — how long copies are kept, and secure deletion afterwards.
The 3-2-1 rule — three copies, two media, one off-site/immutable to survive ransomware.
Encryption — backups encrypted at rest and in transit.
Restore testing — periodic, documented restore tests with results retained; tie to your Recovery Time Objective (RTO).
Responsibilities — who runs, monitors and tests backups.

Common mistakes

Never testing restores until a real incident.
No off-site or immutable copy, so ransomware encrypts the backups too.
Confusing replication with backup — a replicated bad state is still bad.

Framework alignment

Maps to ISO 27001:2022 Annex A 8.13 (information backup), the SOC 2 availability criteria, and NIST CSF Recover (RC.RP).

Primary sources

ISO/IEC 27001:2022 — Annex A control 8.13, information backup (iso.org/standard/27001).
NIST SP 800-34 — Contingency Planning Guide for Federal Information Systems (csrc.nist.gov/pubs/sp/800/34/r1/final).
CISA — ransomware guidance and the 3-2-1 backup principle (cisa.gov).

Generate it in minutes

See a sample backup & recovery policy or generate yours free.

Frequently asked questions

What is the 3-2-1 backup rule?

Keep three copies of your data, on two different media, with one copy off-site or immutable. The off-site or immutable copy is what lets you survive ransomware that also targets backups. It is a practical baseline auditors recognise under ISO 27001 Annex A 8.13.

How often should you test backup restores?

Test restores periodically and document the results, not just when a real incident strikes. An untested backup is a hope, not a control. Tie restore tests to your Recovery Time Objective (RTO) so you can prove you meet it.

What is the difference between RPO and RTO?

RPO (Recovery Point Objective) is how much data loss is acceptable, which sets backup frequency. RTO (Recovery Time Objective) is how fast you must recover, which sets restore-testing targets. A backup policy should define both per system, by criticality.