Data Recovery

Intent of this Standard

Data recovery relates to the process of retrieving deleted, inaccessible, lost, corrupted, or damaged digital information.

In the context of data-loss implications, data recovery is an essential tool in risk mitigation and in maintaining business continuity. With more people working remotely, the risks increase as many employees use their own devices, or work on shared computers. Data recovery protects an organisation by maintaining uptime and minimising impacts on productivity.

Data recovery in the context of this Standard refers to:

• Logical data recovery: addresses issues such as file corruption, formatting, and accidental deletion.
• Physical data recovery: involves repairing hardware issues such as damaged drives or broken components.
• Remote data recovery: the process of recovering data from a location and device remotely.

Minimum capability maturity level

We have established criteria within a maturity model to provide clarity, including the expected minimum implementation level, which is CS-CMM 2.

Cyber Security Capability Maturity Model

The requirements are intended to meet and comply with each respective level of maturity. The levels provide a pathway that can be used by agencies to assess themselves against, with a view to improving maturity over time.

Each maturity level builds on the requirement from the preceding level.

Below are the requirements for each capability maturity level for this Standard.

Focus areas

Focus areas are applicable to the Standard and are provided as a guide and not an exhaustive list. Each agency is best placed to identify areas of relevance.

The focus areas for this Standard are:

• Cloud services
• Remote access
• Business continuity/disaster recovery
• Third party/vendor systems (such as SaaS environments).

Suggested actions

The following list is not exhaustive. Organisations should identify which actions are appropriate to implement the Standard based on their current maturity level. However, the following actions follow good practice guidelines:

• Organisations undertake an asset classification exercise to identify their business-critical and sensitive systems. This could be incorporated into a business impact analysis assessment.
• Data retention requirements are identified and agreed on.
• Recovery point and recovery time objectives are defined.
• Organisations assess and choose data recovery methods appropriate for their situation.
• A data recovery policy is developed.
• Staff training is developed and delivered.
• Data recovery procedures are tested based on likely scenarios including loss of location/sites.

Key dependencies

To implement this Standard, there are likely to be requisite measures or technologies in place.

A number of dependencies apply to multiple standards. In general, these dependencies are less technology-specific and relate to business processes.

Key dependencies for this Standard include:

• An up-to-date understanding of critical business and public-facing systems and roles.
• Executive management buy-in and commitment to business continuity and disaster recovery.
• Data backup and recovery requirements based on a business continuity objective, including:
  • budget and cost
  • resourcing requirements
  • backup schedule
  • recovery time
  • security backup requirements and the resilience of the overall recovery solution are defined.
• The procurement process provides appropriate assurance that vendors are aware of an organisation’s data recovery requirements and can meet them.

Measurable outcomes

To establish whether the Standard is being implemented, the outcomes are a tool an organisation may wish (or already have in place) to measure to help make this determination.

The outcomes have been designed to align with the requirements contained in the maturity level.

Outcomes for this Standard include:

• A data recovery policy is in place, including the date of approval.
• Defined recovery point and recovery time objectives (RPO/RTO).
• Approved training plans.
• Data recovery plan is in place.
• Data recovery audits are regularly undertaken.
• Periodic testing and auditing of recovery plans (incorporating both simulated and real-world recovery).
• Roles and responsibilities for the different types of recovery have been defined.
• Data recovery procedures are in place and regularly tested.
• Evidence of investment to support organisational data recovery requirements.