Backup and Recovery

What It Is and Why It Matters

Backup and recovery refers to the processes, technologies, and policies that ensure organizational data can be restored in the event of data loss, corruption, system failure, or disaster. For the CISA exam, this topic is critical because data is one of an organization's most valuable assets, and the ability to restore it reliably is fundamental to business continuity and resilience.

Auditors must evaluate whether backup strategies are adequate, whether backups are tested regularly, whether storage is secure, and whether recovery procedures can meet the organization's defined Recovery Point Objective (RPO) and Recovery Time Objective (RTO). A backup strategy that cannot meet these objectives is insufficient regardless of how technically sophisticated it may be.

The backup and recovery strategy must also consider regulatory and legal requirements for data retention, the security of backup media (including encryption), and the physical and logical protection of backup storage locations.

Key Concepts and Terminology

Backup Types

• Full Backup: A complete copy of all selected data. Full backups are the most comprehensive but take the longest time to create and require the most storage space. Restoring from a full backup is straightforward because all data is contained in a single backup set.
• Incremental Backup: Copies only the data that has changed since the last backup (whether full or incremental). Incremental backups are fast to create and use less storage, but restoration requires the last full backup plus all subsequent incremental backups in sequence.
• Differential Backup: Copies all data that has changed since the last full backup. Differential backups grow larger over time but simplify restoration, which requires only the last full backup and the most recent differential backup.

Backup Rotation Schemes

• Grandfather-Father-Son (GFS): A hierarchical rotation scheme that maintains daily (son), weekly (father), and monthly (grandfather) backups. This provides multiple recovery points at different granularities while managing storage costs.
• Tower of Hanoi: A more complex rotation scheme that optimizes media usage by cycling tapes or storage media in a pattern that maximizes the number of recovery points with fewer media sets.

Storage Considerations

• Offsite Storage: Backup copies should be stored at a location geographically separate from the primary site to protect against site-wide disasters such as fires, floods, or earthquakes. The offsite location should be far enough away to avoid being affected by the same event but close enough to allow timely retrieval.
• Cloud Backup: Storing backups in cloud services provides geographic redundancy and scalability. Considerations include data encryption (both in transit and at rest), bandwidth requirements, retrieval costs, and compliance with data residency regulations.
• Encryption: Backup media should be encrypted to protect data confidentiality, especially when media is transported or stored offsite. Encryption key management is a critical component; if encryption keys are lost, the backup data becomes inaccessible.

Recovery Testing

Backups are only valuable if they can be successfully restored. Organizations must regularly test their recovery procedures by performing actual restoration from backup media. Testing should verify data integrity, completeness, and the ability to meet RTO and RPO targets. Untested backups provide a false sense of security.

Data Retention Policies

Data retention policies define how long backup data must be maintained based on business needs, regulatory requirements, and legal obligations. Different types of data may have different retention periods. Auditors should verify that retention policies exist, are documented, and are consistently followed.

How This Appears on the CISA Exam

Backup and recovery questions on the CISA exam commonly test:

• The differences between full, incremental, and differential backups, including their trade-offs in speed, storage, and restoration complexity.
• The importance of offsite storage and the criteria for selecting an offsite location.
• The requirement for regular recovery testing and what it should verify.
• The relationship between backup frequency and RPO (more frequent backups support a shorter RPO).
• Encryption requirements for backup media, especially for data in transit and offsite storage.

Study Tips

• Be able to compare full, incremental, and differential backups in terms of backup speed, restoration speed, and storage requirements.
• Remember that incremental backups are fastest to create but slowest to restore, while full backups are slowest to create but fastest to restore.
• Know that backup testing (actual restoration) is essential and that untested backups should be treated as unreliable.
• Understand the connection between RPO and backup frequency.
• Review encryption key management as a critical aspect of backup security.

Related Subtopics

• BCP/DRP planning
• Data classification and data lifecycle management
• Storage technologies (SAN, NAS, cloud storage)
• Replication and mirroring strategies
• Regulatory data retention requirements
• Media management and disposal