[{"data":1,"prerenderedAt":10},["ShallowReactive",2],{"public:public\u002Fcontent\u002Fdocs\u002Fiso-27001":3},{"slug":4,"title":5,"description":6,"draft":7,"updated":8,"html":9},"iso-27001","ISO 27001 A.8.13 evidence for backups","How Verestore's countersigned restore tests support ISO\u002FIEC 27001",false,null,"\u003Ch1>ISO 27001: evidence for control A.8.13\u003C\u002Fh1>\n\u003Cp>ISO\u002FIEC 27001:2022 Annex A control \u003Cstrong>8.13 Information backup\u003C\u002Fstrong> asks that backup copies be maintained \u003Cstrong>and regularly tested\u003C\u002Fstrong> in line with an agreed backup policy. A certification auditor will ask how you test them, how often, and what the last results were.\u003C\u002Fp>\n\u003Ch2>What Verestore gives your auditor\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Regular restore tests.\u003C\u002Fstrong> Daily, weekly or monthly, of your newest PostgreSQL backup, into a disposable database that's deleted when the run ends.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>What was checked.\u003C\u002Fstrong> Every table restored, row counts against the previous run, checksums of the tables you choose, and your own SQL checks against a baseline.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Evidence you can't edit.\u003C\u002Fstrong> Each result is signed by the run and countersigned by Verestore. Anyone can check a report at \u003Ca href=\"mailto:support@verestore.dev?subject=Verestore%20launch\">\u002Fverify\u003C\u002Fa>.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>An evidence pack per period.\u003C\u002Fstrong> A ZIP with the reports, the signed results and a summary for the audit window, plus the coverage sentence on every target.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>How to use it in your ISMS\u003C\u002Fh2>\n\u003Col>\n\u003Cli>In your backup policy, state the restore-test frequency and what a passing test means (for example: all tables present, row counts within 25%, the custom checks pass).\u003C\u002Fli>\n\u003Cli>Connect the backup location with a read-only key (\u003Ca href=\"\u002Fdocs\u002Fgetting-started\">how access works\u003C\u002Fa>) and set the schedule to match the policy.\u003C\u002Fli>\n\u003Cli>In your Statement of Applicability, reference the Verestore targets as the testing evidence for A.8.13; attach the evidence pack for the audit period.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>Verestore produces evidence for this control; it doesn't certify your organisation. Your auditor decides what is sufficient.\u003C\u002Fp>\n",1794290783590]