In order to comply with control A.8.13 Information backup you might implement the following:
- Technology — the technology to enable information backup in most cases will be already available in the company. Companies of all sizes will probably be able to back up the required information by manually copying data from their computers and mobile devices to backup servers, or by using backup services to automate which data from devices and servers will be copied to backup servers.
- Organization/processes — you should set up a process for determining which information to backup, how often, and how to test backup copies. You can document those processes through Security Procedures for IT Department or a Backup Policy.
- People — make employees aware of the importance of backing up information, and train the IT staff on how to perform backup and test backup copies.