EBA欧洲银行-8Annex-3-backup_standard_v7_12页_279kb

European Commission Information System Security Policy: Standard on Back-ups

Core Content

This document outlines the European Commission's Security Standard on Back-ups, adopted in 2011 by Mrs. Irene Souka, Director-General of DG Human Resources and Security, in accordance with Commission Decision C(2006) 3602. It provides a comprehensive framework for the definition, implementation, and management of back-up procedures across all information systems used by the Commission.

Main Objectives

• Ensure the integrity and availability of information and software through effective back-up practices.
• Provide rules and guidelines for back-up controls applicable to all types of electronically stored information.
• Support business continuity planning by ensuring that back-ups are testable and restorable within defined recovery time objectives (RTO) and recovery point objectives (RPO).
• Apply to all data stored by the Commission, including both EUCI (European Union Computerised Information) and non-EUCI systems, with additional requirements for EUCI.
• Exclude archiving from the scope of this standard.

Key Information

Scope of Application

• Applies to all data stored electronically on Commission devices, including:
  • Servers
  • Workstations
  • Portable PCs
  • Network equipment
  • Storage devices
  • USB drives, floppy disks, etc.
• Applies to all personnel handling such information, including officials, contractors, and third parties.

Types of Data and Back-up Requirements

Threats Covered

The standard addresses a wide range of threats, including:

• Physical threats: Fire, water damage, pollution, earthquakes, volcanic activity, meteorological events, floods, air-conditioning failure, power loss, telecommunications failure.
• Technical threats: Equipment failure, software malfunction, data corruption, user error, abuse of rights, forging of rights.

Back-up Rules

• Back-up must be documented for each information system and include:

  • Definition of information to be backed up
  • Frequency of back-ups (based on RPO)
  • Restoration time (based on RTO)
  • Type of back-up (full, incremental, differential)
  • Number of back-up generations to retain
  • Location of back-up storage (at least one remote)
  • Security measures for back-up media in transit
  • Inventory of back-up media and their contents

• Back-up media must be:

  • Replaced based on manufacturer recommendations or earlier if defective
  • Handled with care and disposed of securely
  • Protected to the same level as operational data, and higher if needed

• Restoration procedures must be:

  • Regularly tested
  • Performed within the required RTO
  • Only authorized to restore data to the original or predetermined location
  • Repeated until successful in case of failure

Testing and Restoration

• Testing:

  • Monthly partial tests (e.g., restoring a few random files)
  • Biennial full tests (during business continuity exercises)
  • Must confirm that:
    • Full data restoration is possible
    • Restoration meets the system's RTO
    • Data can be installed on an alternative system
    • Personnel are aware of procedures

• Restoration:

  • Must be authorised and only done to approved locations
  • Can be bypassed in exceptional cases with System Owner approval

Roles and Responsibilities

• System/Data Owner:

  • Defines RPO and RTO
  • Approves back-up arrangements
  • Ensures correct execution of back-ups
  • Requests data restoration when needed

• IT Service Providers (e.g., DIGIT):

  • Operate and maintain back-up/restore solutions
  • Schedule back-ups according to owner requirements
  • Test and verify effectiveness
  • Restore data upon proper authorization
  • Maintain inventory of back-up media and contents

• LISO (Legal, Information, and Security Officer):

  • Ensures back-up media are securely stored and transported

• End Users:

  • Must ensure important data is saved in locations that are backed up

References and Related Documents

• Commission Decision C(2006) 3602
• Implementing rules for C(2006) 3602
• Standard on Risk Management
• Standard on Business Continuity Management
• Standard on Sanitisation of Media
• International standards:
  • ISO/IEC 27001 (2005-06-15)
  • ISO/IEC 17799 (2005-06-15)

Summary

This standard ensures that back-up procedures are comprehensive, secure, and aligned with business continuity and data protection requirements. It emphasizes the importance of regular testing and restoration, defines RPO and RTO as critical factors in determining back-up frequency and recovery time, and outlines clear roles and responsibilities for all stakeholders involved. The document also highlights the need for secure handling of back-up media, both in storage and during transportation, and ensures that personal information is protected in accordance with data protection regulations.