S 6.41 Training data reconstruction

Initiation responsibility: IT Security Officer

Implementation responsibility: Person responsible for the data backup

The reconstruction of data with the help of data backups must be tested sporadically, but at least after each modification to the data backup procedure. Here, it must be demonstrated at least once that complete data reconstruction (e.g. the entire database of a server) is possible. This way, it can be determined reliably whether

• data reconstruction is possible at all,
• the data backup procedure is practicable,
• there is sufficient documentation of the data backup so that a substitute can reconstruct the data, if necessary, and
• the required time for data reconstruction corresponds to the availability requirements.

During data reconstruction training, it should also be taken into consideration that

• the data may need to be installed on an alternative IT system and
• different writing/reading devices are used for data backup and data reconstruction.

Review questions:

• Is the restoration of data backups tested sporadically?