This policy procedure sets out how business data is identified, backed up, tested and restored, and points to the registers that record what data the business holds.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on data backup:

• Data Backup and Electronic Information
• Backup, Business Continuity and ICT Recovery
• ISO 27001 Annex A 8.13 - Information Backup
• Information Security knowledge base

Logo Update Service

Download this policy with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription.

Need Help Implementing?

If you'd like hands-on help setting up backup, testing and restore arrangements, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Data Backup Policy Procedure Template

The Data Backup Policy Procedure is a Word template that sets out how a business manages and controls backups of its data so the data can be recovered after an incident. It covers identifying important data and its risks, backup frequency and storage, offsite backup vendors, periodic testing of backups and requests to restore data.

It applies to all employees and company activities, with disciplinary action for breaches. The file has Title, File Location, Issue No, Issue Date, Controlled By and Approved By fields, an Amendment Record and a Business Use information classification in the footer.

What the Policy Covers

• Amendment record, summary, scope and applicability - the purpose of managing backups so data can be recovered, the activities and staff covered, and disciplinary action for breaches
• Identification of data and risks - important data identified on the document, personal data and information assets registers, with its risks and controls reviewed on an information security risks register
• Information backup management - periodic backup of user and system level information, frequency and extent set by the data owner, and documented, reviewed recovery processes
• Backup media and offsite storage - protected backup media, offsite vendors cleared for the highest level of information held, and system software backups kept apart from operational software
• Test of backup system - periodic testing of backups at a specified frequency to confirm media reliability, information integrity and that data can be recovered
• Restoring backed up data - restoring systems from backup as part of business continuity, a retention period for each backup job, recovery requests and an annual vendor review

Built for Recoverable Business Data

• Backup frequency and extent set by the data owner according to the importance of the information
• Offsite backup vendors cleared to handle the highest level of information stored
• Physical access controls at offsite storage that meet or exceed those of the source systems
• Backups tested at a specified frequency to confirm media reliability and information integrity
• Procedures agreed with any offsite backup storage vendor reviewed at least annually

Who Needs a Data Backup Policy Procedure?

Any business that relies on its electronic data to operate, and the person or IT department responsible for running, testing and restoring its backups.

How the Policy Fits Together

Important data is identified on F-IMS20 Document Register, F-IMS24 Personal Data Register and F-IMS25 Information Assets Register, so backup protection can be checked for adequacy based on risk. The risks and controls for that data are reviewed on the information security risks register the policy names.

Using the Policy

Set the backup frequency, the retention period for each backup job and who handles data recovery requests to match your own arrangements, then name the person in the Controlled By field. Give it top level approval and brief staff on how to request a restore.

Related Documents

GG-8-02 Data Backup Guidance and TT-8-02 Data Backup Training Talk help managers and staff put these backup arrangements into practice.