← Toolkit
TPL-081PolicyIT continuityCyber resilience

Backup and restoration policy

3-2-1-1-0 rule, administration domain isolation, test plan.

A policy aligned with DORA Article 12 and CIS Control 11. It explicitly addresses logical separation — separate accounts, independent authentication, one-way flow — which is the most frequent non-compliance point.

How to use it

  • Test by asking the administrator to delete a recent backup
  • Define an RPO per data class, not a global RPO
  • Document the three levels of restore verification

Courses that use it

IT-202

Backups, immutability and restoration

Related templates

TPL-012

MTPD / RTO / RPO / MBCO register

The reference table of committed durations, with consistency checks.

TPL-020

Continuity strategy comparison

Three costed options per resource, with cost per hour of RTO gained.

TPL-053

Single point of failure register

Qualification, treatment or explicit acceptance, with review date.

TPL-060

Severe scenario library

Twenty ready-to-run scenarios covering the six disruption families.