Internal Use

Backup & Restore Policy

Dispel

Document Control

1. PURPOSE AND SCOPE

1.1 Purpose

This policy establishes requirements for backup and restoration of Dispel and customer data to support business continuity and recovery from failures, corruption, or disasters.

1.2 Scope

This policy applies to:

• All Dispel-managed production systems, data stores, and repositories that create, receive, store, or transmit Dispel or customer data requiring backup.
• All backup infrastructure and storage locations (including cloud services such as AWS/Heroku and S3).
• Disaster recovery and restore capabilities for critical systems.

1.3 Regulatory and Framework Alignment

2. POLICY STATEMENTS

2.1 Management Commitment

Management Commitment Statement

Senior Management at Dispel is dedicated to the protection of our information assets, industrial control systems, and Protected Health Information (PHI). We assume full accountability for the effectiveness of our security program, ensuring it is integrated into all business processes and aligned with our strategic goals. To maintain compliance with ISO 27001, IEC 62443, HIPAA, and NIST 800-53, we formally commit to:

• Resource Provisioning: Providing the necessary financial, technical, and human resources to sustain a robust security posture.
• Risk-Based Governance: Approving security policies and overseeing a continuous risk management process that prioritizes both data privacy and operational safety.
• Operational Resilience: Supporting the security of industrial automation and control systems (IACS) to ensure safety and reliability.
• Continuous Oversight: Conducting regular management reviews to evaluate program performance, audit results, and opportunities for improvement.

2.2 Primary Policy Statement

Dispel SHALL maintain backup and recovery capabilities that:

• Meet business and regulatory requirements for availability and retention.
• Protect backups with appropriate encryption and access controls.
• Support timely restoration of systems and data in the event of incidents or disasters.

2.3 Secondary Policy Statements

At a minimum, Dispel SHALL:

• Maintain an inventory of systems and data in scope for backup and restoration.
• Ensure that backup coverage, frequency, and retention align with data classification and RTO/RPO requirements.
• Use only approved backup platforms and storage locations.

3. REQUIREMENTS

3.1 Backup Frequency and Coverage

Objective: Ensure that critical systems and data are backed up at a frequency that supports business continuity and regulatory requirements.

Mandatory Activities:

1. Production databases and critical systems SHALL be backed up at least every 24 hours; higher-change databases SHALL be backed up more frequently as determined by Engineering / Operations.
2. Backups SHALL include the data necessary to reconstruct the system or database state (e.g., snapshots plus WAL/base backups where applicable).
3. Operational backups SHALL be retained for at least 30 days unless otherwise justified.
4. Backup coverage SHALL be reviewed periodically to ensure new or changed systems are included.

Required Outputs:

• Documented backup configuration and schedules for each critical system.
• Backup job status records and dashboards.

Security Controls: CP-6, CP-9; SOC 2 CC7.x; ISO 27001 A.8.13.

Approval Required: Policy Owner.

3.2 Storage, Encryption, and Access Control

Objective: Protect backups from unauthorized access, disclosure, or tampering.

Mandatory Activities:

1. All backups at rest SHALL use strong encryption (e.g., AES-256) with keys managed in accordance with the Encryption Policy.
2. All backup traffic in transit SHALL use TLS 1.2 or higher.
3. Backups SHALL be stored on highly available storage (e.g., encrypted S3 buckets) and, where appropriate, replicated across regions.
4. Access to backup platforms and configurations SHALL require RBAC and MFA.
5. Administrative access to production data for routine operations SHALL be restricted; emergency access (e.g., forensic analysis, manual disaster recovery) SHALL be formally approved and logged.

Required Outputs:

• Encryption configuration documentation and key management references.
• Access control lists and roles for backup systems.

Security Controls: SC-12, SC-13; SOC 2 CC6.x.

Approval Required: Security Officer, Policy Owner.

3.3 Testing, Monitoring, and RTO/RPO

Objective: Validate that backups can be restored and meet defined recovery objectives.

Mandatory Activities:

1. Restore tests from backups SHALL be performed at least quarterly and after significant changes.
2. Backup jobs SHALL be monitored, and failures SHALL trigger alerts and incident investigation.
3. RTO and RPO targets for critical systems SHALL be defined and documented.
4. Periodic reviews SHALL verify that observed restore performance meets defined RTO/RPO targets.

Required Outputs:

• Restore test reports.
• Documented RTO/RPO values by system tier.

Security Controls: CP-4, CP-6, CP-9.

Approval Required: Policy Owner, Engineering / Operations.

4. ROLES AND RESPONSIBILITIES

4.1 Engineering / Operations

Responsibilities:

• Implement and monitor backup jobs for production systems and data stores.
• Perform periodic restore tests and document results.
• Investigate and remediate backup failures.
• Maintain documentation of backup configurations and RTO/RPO values.

4.2 Security / Compliance

Responsibilities:

• Verify that backup design, frequency, retention, and storage meet this policy and framework requirements.
• Review backup monitoring and incident reports.
• Coordinate evidence collection during audits.

4.3 System Owners

Responsibilities:

• Ensure systems under their responsibility are included in the backup inventory and correctly classified.
• Work with Engineering / Operations to set system-specific RTO/RPO requirements.
• Validate that their systems’ data can be restored within agreed timeframes.

5. PROCEDURES

5.1 High-Level Backup and Recovery Procedure

6. MONITORING AND COMPLIANCE

6.1 Compliance Monitoring

Compliance with this policy SHALL be monitored through:

• Regular review of backup job status and failure alerts.
• Periodic review of restore test reports.
• Internal audits comparing backup configurations against this policy, the Data Classification Policy, and the Data Retention Policy.

6.2 Metrics and Reporting

6.3 Non-Compliance Consequences

Failure to comply with this policy may result in:

• Corrective and preventive actions.
• Disciplinary measures up to and including termination.
• Additional technical or procedural remediation.

7. EXCEPTIONS AND WAIVERS

7.1 Exception Process

Exceptions to this policy SHALL:

1. Be submitted in writing by the requesting party.
2. Include detailed justification and business impact.
3. Describe compensating controls or mitigation measures.
4. Define exception duration and remediation plan.

7.2 Exception Approval Authority

8. DEFINITIONS

Backup: A copy of data stored for the purpose of recovery in case of loss, corruption, or disaster.

RTO (Recovery Time Objective): The maximum acceptable time required to restore a service after an outage.

RPO (Recovery Point Objective): The maximum acceptable amount of data loss measured in time.

Production System: Any system that processes, stores, or transmits live Dispel or customer data.

9. REFERENCES

9.1 Internal References

• Backup Policy
• Data Classification Policy
• Data Retention Policy
• Encryption Policy
• Incident Response Policy

9.2 External References

• NIST SP 800-34, Contingency Planning Guide for Federal Information Systems
• NIST SP 800-53, Contingency Planning (CP) family
• ISO/IEC 27001 Annex A.8.13 – Information backup

10. DOCUMENT HISTORY

11. APPROVAL SIGNATURES

END OF POLICY

APPENDICES

Appendix A: Backup and RTO/RPO Examples

Appendix B: Platform-Specific Backup Notes

• Databases (AWS/Heroku): Snapshots, base backups, and WAL files persisted to S3; continuous protection and automated backup monitoring via Heroku Postgres.
• Source Code (GitHub): Source code stored in Git repositories hosted by GitHub, which is responsible for repository backup and redundancy.