Extends ISO/IEC 27002:2022 8.13. Cloud systems add to or replace off-site backup as protection against data loss and for continuity and restoration, and several copies of data are kept in physically or logically separate locations, possibly within the system, for backup or recovery. PII backup may be the customer's responsibility, but a processor that explicitly offers backup and restore explains clearly what the service provides. Processing can be restored within a stated, documented time after disruption; backup and recovery procedures are reviewed at a stated, documented frequency (jurisdictions may fix backup and review frequencies). Sub-contractors holding replicas or backups fall under the sub-contracting controls and physical media transfers under this document's controls. A backup policy covers backup requirements and any further contractual or legal requirements to erase PII held in backups.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.