Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am wondering if IT Auditors use a methodology or framework to audit a backup policy.

Here is a example of a different kind incase my question does not make sence:

~~~~~~~~~~~~~~~~~~~~~~~~~ A programmer may use a methodology which refers to the 'Waterfall Method' in relation to their design/ approach. ~~~~~~~~~~~~~~~~~~~~~~~~~

share|improve this question

closed as not a real question by Iszi, Scott Pack, AviD Feb 23 '12 at 21:31

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

The simple answer is yes - auditors tend to use frameworks as it makes the work repeatable year-on-year and consistent. But I don't understand the rest of your question - can you provide more context. – Rory Alsop Jan 27 '12 at 14:11
I think in terms of IT ISO20001 is something which is tested against for management. I have found out that they follow a typical audit check list to test there systems. – Jonathon Legg Jan 27 '12 at 15:45
What I meant was, what specifically are you asking for in your question? Examples of the types of frameworks? There are many! – Rory Alsop Jan 27 '12 at 17:08

It depends on the industry. Healthcare? Retail?

For instance, Healthcare has accreditation bodies like Joint Commission who primarily rely on HIPAA as a guide. Retail is expected to follow PCI standards to protect customer financial data (like credit card information).

Ultimately, all backup audits will typically look at several key concerns:

  • backup frequency
  • maximum Return to Operation time using current backup method
  • Data retention policies
    • some industries require a minimum retention time
  • Security of the backup media
    • physical security
    • offsite storage
    • encryption

Obviously, there may be other concerns, but those are the highlights.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.