OPS-08 Data Backup and Recovery - Regular Testing
Changed since C5:2020
Basic criterion
Specified which data types the criterion applies to.
Added requirement regarding the environments that cloud service customer data can be restored into.
Added requirement for the documentation of restore tests.
Additional criterion
Added requirement about including restore tests in the cloud service provider's business continuity management.
Wording in C5:2020
Basic criterion
Restore procedures are tested regularly, at least annually. The tests allow an assessment to be made as to whether the contractual agreements as well as the specifications for the maximum tolerable downtime (Recovery Time Objective, RTO) and the maximum permissible data loss (Recovery Point Objective, RPO) are adhered to (cf. BCM-02).
Deviations from the specifications are reported to the responsible personnel or system components so that these can promptly assess the deviations and initiate the necessary actions.
Additional criterion
At the customer's request, the Cloud Service Provider inform the cloud customer of the results of the recovery tests. Recovery tests are embedded in the Cloud Service Provider's emergency management.
Supplementary information on all sub-criteria
If the data backup has not been contractually agreed between the cloud service provider and the cloud service customer, this criterion is not applicable. The cloud service provider transparently presents this situation in the system description.
Basic criterion
Restore procedures are tested regularly, at least annually. The tests include cloud service provider data and, if contractually agreed upon, cloud service customer data and cloud service derived data.
Supplementary information
The use of cloud service customer data in backup and restore procedures as described in the basic criterion is a carefully considered exception. This exception does not extend to general software development or other testing environments and the use of cloud service customer data for testing is restricted specifically to backup and restore procedures.
The tests allow an assessment as to whether the contractual agreements as well as the specifications for the maximum tolerable downtime (Recovery Time Objective, RTO) and the maximum permissible data loss (Recovery Point Objective, RPO) are adhered to (cf. BCM-02).
Cloud service customer data is only restored in environments that are subject to the same access restrictions as the production environment.
Supplementary information
If cloud service customer data is restored in an environment with differing access restrictions, the confidentiality of the data may be affected.
Performed restore tests are thoroughly documented. This also includes the documentation of the safe disposal of the restored data.
Deviations from the specifications are reported to the responsible personnel or system components so that these can timely assess the deviations and initiate the necessary actions.
Additional criterion
OPS-08.01AC
Additional, complementingAt the customer's request, the cloud service provider informs the cloud service customer of the results of the restore tests.
OPS-08.02AC
Additional, complementingRestore tests are included in the cloud service provider's business continuity management.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that they actively request information on the results of restore tests from the cloud service provider. Customers assess the effectiveness of applied data recovery strategies and integrate insights into their own emergency plans in alignment with their business needs and security standards.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources