PDP-4 Backup Retention

What is this control about?

Backup retention is a strategy that determines what data the organization keeps, where it keeps it, and for how long it keeps the data. The retention strategy must be documented in the policy.

Available tools in the marketplace

Tools

No tool recommendation is made for this section

Available templates

TrustCloud has a curated list of templates, internally or externally sourced, to help you get started. Click on the link for a downloadable version:

• Data backup template from National CyberSecurity
• Backup best practices from NIST

Control implementation

NOTE: This control is 100% automated by TrustCloud. Connect your system to enjoy the benefits of automation.

To manually implement this control: 

1. Define the backup retention strategy in the backup policy using NIST best practices.
2. Enable the retention strategy for the backed-up data.

What evidence do auditors look for?

Most auditors, at a minimum, are looking for the below-suggested action:

1. Provide a screenshot of the backup retention schedule.

Evidence example

For the suggested action, an example is provided below:

1. Provide a screenshot of the backup retention schedule.
   The following screenshot shows an example of the retention schedule.
   Google search