BDRP-10ISO/IEC 27001:2022 A.8.13, A.8.14SOC 2 A1.2, A1.3
Backup & Disaster Recovery (BCP/DR) Policy Template
Establish formal Recovery Time Objectives (RTO: 4h) and Recovery Point Objectives (RPO: 24h), automated daily cloud backups, and annual restoration test procedures.
Mandatory Controls Enforced in This Policy
Defined Recovery Point Objective (RPO: < 24 hours) and Recovery Time Objective (RTO: < 4 hours)
Automated daily database and volume snapshots encrypted at rest with 90-day retention
Geographic multi-region snapshot replication to prevent regional cloud outages
Mandatory annual backup restoration drills with documented recovery test logs
backup-disaster-recovery-rto-rpo-policy.md
LIVE ISMS SPEC
# Backup & Disaster Recovery Policy (BDRP-10)
**Classification:** Internal / Operations
**Controls Mapped:** ISO/IEC 27001:2022 A.8.13, A.8.14 | SOC 2 A1.2, A1.3
---
## 1. Recovery Objectives
- **RPO (Recovery Point Objective):** Maximum acceptable data loss threshold is **24 hours**.
- **RTO (Recovery Time Objective):** Maximum acceptable service restoration downtime is **4 hours**.
## 2. Backup Schedule & Encryption
1. **Frequency:** Automated daily snapshots of all production databases and object stores.
2. **Encryption:** All backup archives are encrypted at rest using AES-256 with KMS keys.
3. **Retention:** Daily snapshots retained for 90 days; weekly snapshots retained for 1 year.
## 3. Annual Restoration Testing
At least once every 12 months, the DevOps team will execute a simulated restoration drill to verify data integrity and compliance with RTO/RPO targets.
This is 1 of 18 policies compiled dynamically in LeanSec Studio.Open Full Studio Editor
Auditor Evidence Checklist for BDRP-10
Audit-ReadyWhen an ISO 27001 or SOC 2 auditor reviews this policy, they will ask for the following artifacts:
Cloud snapshot schedule configuration screenshots (AWS Backup / GCP Snapshots)
Documented record of the most recent annual restoration drill with timed RTO results
Frequently Asked Questions
What is the difference between RTO and RPO for ISO 27001?
RPO (Recovery Point Objective) measures maximum tolerable data loss in time (e.g. 24h of data). RTO (Recovery Time Objective) measures maximum tolerable downtime until service is restored (e.g. 4h).