§164.308(a)(7)(ii)(B): Establish (and implement as needed) procedures to restore any loss of data.
Audit Inquiry
Does the entity have policies and procedures in place to restore any lost data?
Does the entity restore any lost data?
Obtain and review documentation related to a disaster recovery plan. Review and determine if appropriate procedures for restoring any loss of data has been incorporated into the disaster recovery plan.
Obtain and review procedures for restoring lost data. Evaluate if the procedures include all important sources of data.
Elements to review may include but are not limited to:
• Workforce members’ roles and responsibilities in the process of restoring lost data
• Determination of what data will be restored
• Step-by-step process of how data will be restored
• Identify occurring events (e.g., disruption, compromise, failure) that require data restoration
• Timeframe of data restoration
• How frequently data restorations will be tested or assessed for verification of media reliability and data integrity
Obtain and review documentation of data restore tests and test results. Evaluate and determine if test procedures are in accordance with data restore plans and/or procedures; that test results are properly documented; that test results are reviewed and certified by appropriate management; and, if necessary, corrective actions have been taken.
Required/Addressable
Required