Backup and recovery audit program.
How to audit whether backups are complete, protected and actually recoverable, based on the IT baseline protection module CON.3 data backup concept.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation backs up data and systems so that they can be restored after an outage, an error or an attack within the required time and to the required data state. What matters is evidence that recovery works, not only that backups run.
Scope
- Servers, virtual machines, databases, business applications and file storage in the data centre and, where relevant, at sites
- Data in cloud and SaaS services, where the organisation is responsible for backing it up
- Backup software, storage systems, media and storage locations
- Out of scope: archiving to meet retention obligations, unless agreed separately
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A data backup concept exists, is approved and is current. | BSI CON.3 | Read the concept, establish approval and date of the last review, and ask who is responsible. | Data backup concept with approval record and version |
| 2 | Tolerable data loss and recovery time per system are derived from the requirements of the business processes. | BSI CON.3; BSI DER.4 | Compare the targets per system with the results of the impact analysis and ask about deviations. | Overview of targets per system, impact analysis |
| 3 | All relevant systems and data are included in the backup. | BSI CON.3 | Compare the system overview and the configuration management with the backup jobs and identify systems that are not backed up. | System overview, list of backup jobs |
| 4 | Methods, schedules and retention of backups correspond to the requirements of the concept. | BSI CON.3 | For a sample of systems, compare the configuration of the backup jobs with the concept. | Extract of job configuration, concept |
| 5 | Backup runs are monitored, errors are handled and closed in a traceable way. | BSI CON.3 | Review the logs of one month, select failed runs and follow their handling through to closure. | Backup logs, notifications and tickets for failed runs |
| 6 | Backups are protected against manipulation and encryption by malware, for example through separate credentials and immutable or separately stored copies. | BSI CON.3; NIS2 Directive Art. 21(2)(c); ISO/IEC 27001:2022 Annex A 8.13 | Check access rights to the backup system and media and establish whether at least one copy cannot be changed from the production environment. | Authorisation extract, architecture overview, configuration of immutable storage |
| 7 | Backup media and stored backups are protected against unauthorised access and encrypted where needed. | BSI CON.3 | Check encryption settings and access rights and review key management. | Configuration extract, key management concept |
| 8 | At least one copy is stored at a location physically separate from the production system. | BSI CON.3 | Review the storage locations and assess the physical and organisational separation. | List of copy locations, site visit note or provider evidence |
| 9 | Restores are tested regularly; the result and the time required are compared with the targets. | BSI CON.3; ISO/IEC 27001:2022 Annex A 8.13 | Check the test plan and test records of the last twelve months and, where possible, observe a restore. | Test plan, test records with time measurement, deviation reports |
| 10 | The recovery procedure is documented, owners are named and the documentation is available even if the main environment fails. | BSI CON.3; BSI DER.4 | Read the manual, check where it is stored and establish whether the documents are accessible offline. | Recovery manual, list of owners, storage concept |
| 11 | Retention and deletion periods for backups are defined and observed. | BSI CON.3 | Compare the periods with the settings of the backup software and the existing stock. | Retention rules, extract of backup inventory |
| 12 | For cloud and SaaS services it is clear who backs up which data, and the provider commitment can be evidenced. | ISO/IEC 27001:2022 Annex A 5.23 | Read contracts and service descriptions on data backup and request evidence of backup and recovery. | Contract extracts, service description, provider confirmations |
| 13 | Those responsible regularly receive metrics on success rate, test results and open deficiencies. | NIS2 Directive Art. 21(2)(f) | Review the reports of the last twelve months and follow up actions on deficiencies found. | Reports, action list |
Documents to request
- Data backup concept and recovery manual
- Targets for tolerable data loss and recovery time per system
- System overview and list of backup jobs
- Backup logs of one continuous month
- Test plan and test records of restores
- Authorisation extract for the backup system and media
- Contracts and service descriptions of cloud and backup providers
- Reports on backup metrics
Typical findings
- Restore tests never took place or covered only single files, not complete systems.
- New systems have not been added to the backup.
- The backup system can be reached with the same administrator accounts as production.
- There is no copy that is protected against encryption by malware.
- Failed runs are not followed up; some systems have been without a valid backup for weeks.
- The measured recovery time is clearly above the target of the business unit.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing