Backup restoration failures and the limits of a 'green' dashboard
You are auditing Helios Health, a 42-server clinical records provider, against ISO/IEC 27001:2022. The backup dashboard shows 100% 'successful' jobs for the last 12 months. The backup administrator says restores are tested 'when needed'. You ask for restore test records: three production servers were selected for a test last month; two failed with corrupted indexes, one restored successfully. The last documented full restore test was 14 months ago. A ticket for one failed restore says 'resolved' after the administrator rebuilt the server manually, but no root cause is recorded. The risk register lists 'loss of clinical records' as high risk with a recovery time objective of four hours. Management review minutes report backup success as a key metric.
1. What is the audit issue, and what evidence would you gather before deciding between a minor and a major nonconformity?
Read the worked answer
Issue. ISO/IEC 27001:2022 Annex A control A.8.13 requires backup copies of information and software to be maintained and tested regularly in accordance with an agreed procedure. Clause 9.1 requires monitoring and measurement to show the ISMS is effective. A 100% job-success dashboard measures job completion, not restorability.
Evidence to gather:
- the agreed backup and restore procedure, including test frequency and acceptance criteria;
- the scope of backups versus the 42 servers and the four-hour recovery objective;
- restore test records across different platforms, not just the three selected;
- whether the failed restores were treated as incidents and whether management knew;
- whether any compensating control exists, such as replication or snapshots, and whether it has been tested against the recovery objective;
- the risk assessment's treatment decision for 'loss of clinical records' and whether management accepted the residual risk knowingly.
Severity test. Two of three sampled servers failing, no test for 14 months, and 'success' reported as the metric suggest the control is not effective and management has a false picture. That points to a major nonconformity unless evidence shows the failures are isolated to legacy servers with a genuinely tested compensating control. The auditor should not decide from the dashboard alone.
2. The IT manager says the two failed restores were 'known issues' and offers to show you a successful restore of a different server. How do you respond?
Read the worked answer
I would thank the manager and accept the offer only as additional evidence, not as a substitute for sampling. I would explain that the sample was selected to represent the population and that a successful restore of an easier server does not explain the two failures.
I would ask for:
- the list of 'known issues' and where they are documented;
- whether the affected servers are in the clinical records path and whether the four-hour objective is achievable for them;
- whether the risk assessment records this limitation and who accepted it;
- whether the manual rebuild has been timed and whether it meets the objective.
I would keep the audit trail: record what was requested, what was provided and what was refused. If the manager cannot demonstrate that the failures are isolated and risk-accepted, the finding stands. I would not allow the discussion to become a negotiation about whether the dashboard is 'green'; the criterion is restorability against the agreed procedure and recovery objective.
3. Draft the conclusion you would take to the audit team closing meeting, including how you would phrase the nonconformity.
Read the worked answer
Finding (major): 'Backup restoration has not been demonstrated to be effective. Of three production servers tested, two failed to restore; no full restore test was documented for 14 months; failed restores were closed without recorded root cause. The agreed procedure and the four-hour recovery objective for clinical records were therefore not shown to be met. Requirement: A.8.13; clause 9.1.'
Conclusion: the ISMS does not provide sufficient confidence that clinical records can be recovered within the stated objective. This affects a key control for a high risk and is likely to affect the certification decision unless corrected and verified.
Client communication: state the evidence, the requirement and the effect. Avoid prescribing the technical fix; the client owns the correction and corrective action. Ask for root-cause analysis covering procedure, test coverage and management oversight, not just a re-test of the two servers. Record the finding in the audit report and retain the sampled server list and test evidence.