PDP-2 Restore Testing

What is this control about?

Restore testing is performed more frequently than disaster recovery testing. This ensures that the organization can retrieve backup data on a regular basis.

There is no formal test required. This is left to the discretion of each organization. The organization must identify the critical data that would need to be recovered and perform a test of this recovery at least quarterly.

Available tools in the marketplace

Available templates

TrustCloud has a curated list of templates internally or externally sourced to help you get started. Click on the link for a downloadable version:

• Backup Restore Template

Control implementation

Perform a data recovery to confirm that backup data will be available in the event that the main database is unavailable. Document your step by step process in a ticket.

Repeat the test at least quarterly.

What evidence do auditors look for?

Most auditors, at a minimum are looking for the below suggested action:

• Provide the before and after screenshots of the data recovery demonstrating that the data was recovered from one point to another (Typically documented in a ticketing system)
• Provide a screenshot showing the tracking of all the restore tests performed

Evidence example

From the suggested action above, an example is provided below.

1. Provide the before and after screenshots of the data recovery demonstrating that the data was recovered from one point to another 

TrustCloud example ticket includes the restore strategy, the before and after and restore results.

2. Provide the screenshot showing the tracking of all the restore tests performed.

These screenshots of the EC2, S3, RDS backup restore example should be included as attachment to the restore ticket:

Google search

S3 versioning example

Google search

RDS example

Google search