Discussion
Open question
- Posts
A statement that data is backed up does not prove that the service can recover within the buyer’s required timeframe. What should be tested?
Accepted answerDefine recovery time, acceptable data loss, systems and data covered, backup frequency, geographic and account separation, encryption, retention, deletion, and restoration responsibilities. Ask for recent restore-test evidence and how partial or corrupt data is handled. Align the contract and continuity plan with service criticality. The NIST Cybersecurity Framework includes recovery outcomes as part of cybersecurity risk management.
- You must be logged in to reply to this topic.