Content library
Katakri 2020
I-20: TIETOJENKÄSITTELY-YMPÄRISTÖN SUOJAUS KOKO ELINKAAREN AJAN – VARMUUSKOPIOINTI

Requirement description

Turvallisuusluokiteltua tietoa sisältävät varmuuskopiot suojataan niiden elinkaaren ajan vähintään vastaavan tasoisilla menetelmillä, kuin millä alkuperäinen tieto on suojattu.

How to fill the requirement

Katakri 2020

I-20: TIETOJENKÄSITTELY-YMPÄRISTÖN SUOJAUS KOKO ELINKAAREN AJAN – VARMUUSKOPIOINTI

Task name
Priority
Status
Theme
Policy
Other requirements
Encryption of backup data
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Encryption
20
requirements

Examples of other requirements this task affects

12.3: Backup
ISO 27001
10.1.1: Policy on the use of cryptographic controls
ISO 27001
12.3.1: Information backup
ISO 27001
TEK-20: Varmuuskopiointi
Julkri
8.13: Information backup
ISO 27001
See all related requirements and other information from tasks own page.
Go to >
Encryption of backup data
1. Task description

When the confidentiality of backups is important, backups are protected by encryption. The need to encrypt backups may become highlighted when backups are stored in a physical location where security policies are unknown.

Regular testing, evaluation, and recovery instructions for backups
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Backups
31
requirements

Examples of other requirements this task affects

12.3: Backup
ISO 27001
12.1.1: Documented operating procedures
ISO 27001
12.3.1: Information backup
ISO 27001
PR.IP-4: Backups
NIST
TEK-20: Varmuuskopiointi
Julkri
See all related requirements and other information from tasks own page.
Go to >
Regular testing, evaluation, and recovery instructions for backups
1. Task description

The media used for backups and the restoration of backups are tested regularly to ensure that they can be relied on in an emergency.

Accurate and complete instructions are maintained for restoring backups. The policy is used to monitor the operation of backups and to prepare for backup failures.

Documenting and delegating ownership of own backup processes
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Backups
24
requirements

Examples of other requirements this task affects

12.3: Backup
ISO 27001
12.3.1: Information backup
ISO 27001
I24: Varmuuskopiointi
Katakri
PR.IP-4: Backups
NIST
TEK-20: Varmuuskopiointi
Julkri
See all related requirements and other information from tasks own page.
Go to >
Documenting and delegating ownership of own backup processes
1. Task description

In connection with the data systems listing, we describe for which systems we are responsible for the implementation of the backup. The organization’s own backup processes are documented and an owner is assigned to each. The documentation includes e.g.:

  • which system is used for backing up data?
  • how are the backups protected (encryption, physical location)?
  • how long are the backups retained?
Determining responsibilities for backing up important information assets
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Backups
21
requirements

Examples of other requirements this task affects

12.3: Backup
ISO 27001
12.3.1: Information backup
ISO 27001
I24: Varmuuskopiointi
Katakri
PR.IP-4: Backups
NIST
TEK-20: Varmuuskopiointi
Julkri
See all related requirements and other information from tasks own page.
Go to >
Determining responsibilities for backing up important information assets
1. Task description

With adequate backups, all important data and programs can be restored after a disaster or media failure. An important first step in a functional backup strategy is to identify who is responsible for backing up each piece of data. Determining the responsibility for backup is the responsibility of the owners of the information assets (systems, hardware).

If the backup is the responsibility of the partner, we will find out:

  • how comprehensively does the partner back up the data?
  • how the data can be recovered if necessary?
  • how the backups are agreed in the contracts?

If the backup is our own responsibility, we will find out:

  • whether the data backup process exists and is documented?
  • whether the coverage and implementation cycle of the backup is at the level required by the importance of the data?
Tietojen erottelumenettelyt varmistusjärjestelmissä (TL IV)
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
System management
Data system management
2
requirements

Examples of other requirements this task affects

TEK-20.1: Varmuuskopiointi
Julkri
I-20: TIETOJENKÄSITTELY-YMPÄRISTÖN SUOJAUS KOKO ELINKAAREN AJAN – VARMUUSKOPIOINTI
Katakri 2020
See all related requirements and other information from tasks own page.
Go to >
Tietojen erottelumenettelyt varmistusjärjestelmissä (TL IV)
1. Task description

Käsiteltäessä samalla varmistusjärjestelmällä eri omistajien tietoja, tarkastusoikeuden mahdollistavat erottelumenettelyt on toteutettava varmistusjärjestelmän liittymien ja tallennemedioiden osalta (esim. omistaja-/hankekohtaiset eri avaimilla salatut nauhat, joita säilytetään asiakaskohtaisissa kassakaapeissa/kassakaappilokeroissa).

Varmuuskopioiden rekisteröinti ja käsittelyn seuranta (TL III)
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Backups
2
requirements

Examples of other requirements this task affects

TEK-20.2: Varmuuskopiointi - varmuuskopioiden rekisteröinti ja käsittelyn seuranta - TL III
Julkri
I-20: TIETOJENKÄSITTELY-YMPÄRISTÖN SUOJAUS KOKO ELINKAAREN AJAN – VARMUUSKOPIOINTI
Katakri 2020
See all related requirements and other information from tasks own page.
Go to >
Varmuuskopioiden rekisteröinti ja käsittelyn seuranta (TL III)
1. Task description

Varmuuskopioista on rekisterit ja varmuuskopioiden käsittely kirjataan sähköiseen lokiin, tietojärjestelmään, asianhallintajärjestelmään, manuaaliseen diaariin tai tietoon (esimerkiksi dokumentin osaksi).

Defining a backup strategy
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Backups
15
requirements

Examples of other requirements this task affects

12.3.1: Information backup
ISO 27001
12.3: Backup
ISO 27001
TEK-20: Varmuuskopiointi
Julkri
8.13: Information backup
ISO 27001
A1.2: Recovery of infrastructure according to objectives
SOC 2
See all related requirements and other information from tasks own page.
Go to >
Defining a backup strategy
1. Task description

With adequate backups, all important data and programs can be restored after a disaster or media failure. To determine your backup strategy, it is important to map / decide on at least the following:

  • What systems are on our responsibility to back up?
  • How critical is each data asset and how often, based on this, they need to be backed up and to what extent (partial or complete copy)?
  • Where are backups stored and how are they protected?
  • How long will backups need to be retained?
  • What system is used for doing the back up?
  • How backup media is destroyed reliably

Tasks included in the policy

Task name
Priority
Status
Theme
Policy
Other requirements
No items found.

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way
Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.
Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.
Do it once - we automatically apply it to all current and future frameworks.
Get to know Cyberday
Start your free trial
Cyberday is your all-in-one solution for building a secure and compliant organization. Whether you're setting up a cyber security plan, evaluating policies, implementing tasks, or generating automated reports, Cyberday simplifies the entire process.
With AI-driven insights and a user-friendly interface, it's easier than ever to stay ahead of compliance requirements and focus on continuous improvement.
Clear framework compliance plans
Activate relevant frameworks and turn them into actionable policies tailored to your needs.
Credible reports to proof your compliance
Use guided tasks to ensure secure implementations and create professional reports with just a few clicks.
AI-powered improvement suggestions
Focus on the most impactful improvements in your compliance with help from Cyberday AI.