ISO 27002:2022 8.14: Redundancy of information processing facilities
Information processing facilities are to be built with enough redundancy to satisfy availability requirements. Purpose: keep processing facilities operating without interruption. Guidance: identify availability requirements for business services and information systems and design and build a systems architecture with redundancy that meets them. Redundancy can mean duplicating facilities partly or completely, from spare components to two of everything. Plan and implement procedures for bringing redundant components and facilities into use, stating whether they are always active or activated automatically or manually in an emergency; redundant elements must be secured as strongly as the primary ones. Mechanisms should alert the organization to failures, allow the planned procedure to run and keep services available while facilities are repaired or replaced. Consider contracting several providers for network and critical processing services, internet access among them; redundant networks; mirrored systems in two data centres in different locations; physically redundant power supplies or sources; multiple parallel software instances with automatic load balancing within or across data centres; and duplicated components within systems (processors, disks, memory) or networks (firewalls, routers, switches). Where it applies, and ideally on live systems, test that failover between components works as intended. Other information: redundancy is closely linked to ICT readiness for continuity (5.30), especially where recovery times are short; copying data to duplicates can introduce integrity errors and weakly secured duplicates can compromise confidentiality, so both must be designed for; redundancy does not usually cure faults within an application; public cloud allows multiple live copies in several places, failing over and balancing load automatically, discussed in ISO/IEC TS 23167.
This control maps to 64 controls across 23 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
You are reading one control. How much of ISO 27002:2022 have you already done?
ISO 27002:2022 8.14 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.