ISO 27001: prove backup, restore and service-recovery controls for vsms

[stephane-segning]

Context

vsms already has backup and restore-drill capability. ISO/IEC 27001 readiness requires that capability to produce repeatable evidence tied to approved recovery objectives and to cover dependencies needed for a real recovery.

Relevant control themes include information backup, availability, ICT readiness for business continuity and documented operating procedures.

Scope

Turn existing backup/restore work into a recurring, auditable recovery control. Consume organisation-approved RTO/RPO targets from the BIA rather than inventing them in this repository.

Cover database state, configuration needed to reconstruct service, cryptographic/key dependencies, carrier/provider dependencies and restore behaviour after retention/deletion jobs.

Acceptance

• Every stateful component is classified as backed-up, reconstructible or deliberately ephemeral.
• Backup encryption, retention, access and integrity checks are documented.
• Existing restore drill is repeatable and proves application-readable state after recovery.
• Drill evidence records timestamps and measured recovery/data-loss windows against approved RTO/RPO targets.
• Restore tests cover migration/schema compatibility and required key/secret/config dependencies.
• Recovery does not silently resurrect data beyond its approved retention lifecycle.
• Failed backup/restore verification produces an actionable alert/ticket path.
• External carrier/provider dependencies that cannot be restored by vsms have documented degraded/failover behaviour.