Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) 32(1)-(3): Set backup and archiving rules aligned to the security policy that fix what is backed up, the technology, backup type, frequency, number of copies, retention per copy, storage location, protection against unauthorised access, usage scenarios and the approver, all determined with the information owner and matched to the recovery time objective

What does 32(1)-(3) require?

Internal rules or instructions, derived from the objectives and strategic lines of the security policy, protect information integrity when an incident affects availability. They regulate the processes, activities and responsibilities for backup and archiving and specify at least: the information to back up or archive (databases, configuration files, system images and so on); the technology used; the backup type (incremental, full and so on); frequency; number of copies; retention period for each copy, set by legal requirements and risk assessment; storage location of each copy; protection against unauthorised physical and logical access; the scenarios in which copies are used; and the person authorised to approve their use. Every parameter is set by the information owner or with the owner's approval and must satisfy the recovery time objective for the required level of service availability.