Register Owner: CTO + CISO
Effective Date: June 13, 2026
Reviewed: Annually and after DR tests
Frameworks: SOC 2 A1 / CC9.1; ISO 27001 A.8.13–A.8.14, A.5.29–A.5.30. Supports the Business Continuity Policy, RTO/RPO Matrix, and DR & Backup-Restore Test Procedure.
Effective Date: June 13, 2026
Reviewed: Annually and after DR tests
Frameworks: SOC 2 A1 / CC9.1; ISO 27001 A.8.13–A.8.14, A.5.29–A.5.30. Supports the Business Continuity Policy, RTO/RPO Matrix, and DR & Backup-Restore Test Procedure.
Backup & DR flow
Controls
- Backups are automated and encrypted, written to a separate location/account from production.
- Restore tests run at least quarterly per data store; results recorded per the DR & Backup-Restore Test Procedure.
- DR exercise at least annually, with at least one live failover per two-year period; after-action recorded.
- RTO/RPO targets per data store are defined in the RTO/RPO Matrix.
- Backups inherit the deletion obligations in the Records Retention Schedule; customer-deletion requests propagate to backups within the rotation window.
Cross-references
- Business Continuity Policy · RTO/RPO Matrix · DR & Backup-Restore Test Procedure
- Tabletop Exercise Report template
Version history
| Version | Date | Description | Author | Approved by |
|---|---|---|---|---|
| 1.0 | June 13, 2026 | Initial backup & disaster-recovery diagram. | Cameron Wolfe | Ishan Jadhwani |