This standard defines the minimum controls to ensure that Company’s information is available for critical processing through the implementation of controls ensuring that business information is backed-up and restorable when data on primary processing media is lost or corrupted. This includes the need for processes and procedures that ensure correct and appropriate handling, as well as suitable protection of backed-up media and data such as physical or logical protection measures. In addition, records need to be maintained of the actions taken on backed-up data.

Finally, when disposing of, or considering re-using backup media, care must be taken to protect against the inadvertent or deliberate exposure of Company’s information.