Control · BCP-01

Backup restore and DR are tested

Operations & ResilienceSOC 2 · ISO 27001 · ITGC · RBIRisk Medium

Requirement to validation

Requirement
ISO-A.5.30 · ISO-A.8.13 · ITGC-OP-01 · RBI-ITGRCA-2023-8 · SOC2-A1.2 · SOC2-A1.3
mapped
Policy
Business Continuity & Backup Policy
pol-bcp
Control
BCP-01
Backup restore and DR are tested
Application
Amazon Web Services (ap-south-1) · Microsoft Azure (corporate)
mapped
Evidence · Q3
6 items
4 approved · 2 pending · 0 rejected
Test · Q3
Pass
TST-ISO-BCP-01 · High confidence
Finding
F-ISO-01 · Medium
Closed
Action
Rahul Nair
REM-F-ISO-01 · Closed
Validation
Validated
as recorded

What should be true

A restore test of each critical system is performed at least semi-annually and a full DR drill annually; results are compared to RTO 4h / RPO 15m and reported to the IT Strategy Committee.

Requirements
ISO-A.5.30 A.5.30 · ICT readiness for business continuity
ISO-A.8.13 A.8.13 · Information backup
ITGC-OP-01 ITGC-OP-01 · Backups are performed, monitored and restorable
RBI-ITGRCA-2023-8 RBI-ITGRCA-2023 §8 · Business continuity and DR — backup, restoration testing and DR drills (RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023)
SOC2-A1.2 A1.2 · Environmental protections, backup and recovery infrastructure
SOC2-A1.3 A1.3 · Tests recovery plan procedures
Policy
pol-bcp · Business Continuity & Backup Policy
Applications
Amazon Web Services (ap-south-1)Microsoft Azure (corporate)
Third parties
—
Testing procedure
Documented restore runbooks; results uploaded as manual evidence. Tests: Amazon Web Services (ap-south-1): Portal DB restore test report; Microsoft Azure (corporate): SAP HANA restore test report. Frequency semi-annual.

Findings (2)

Open list →
FindingObservationControlApplicationsSeverityStatusOwnerActionValidation
F-IAQ2-BCP-01Restore test evidence incompleteBCP-01Amazon Web Services (ap-south-1), Microsoft Azure (corporate)MediumClosedRahul NairREM-F-IAQ2-BCP-01 · ClosedValidated
F-ISO-01SAP HANA restore test exceeded RTO (internal ISMS audit, carried into surveillance)BCP-01Amazon Web Services (ap-south-1), Microsoft Azure (corporate)MediumClosedRahul NairREM-F-ISO-01 · ClosedValidated

Evidence (8)

Open list →
EvidenceTitleControlSource systemCollectedStatus
ISO-REQ-020AWS: Portal DB restore test reportBCP-018 Oct 2026Accepted
ISO-REQ-021Microsoft Azure: SAP HANA restore test reportBCP-017 Oct 2026Accepted
ITGC-REQ-029AWS: Portal DB restore test reportBCP-019 Oct 2026Under review
Q2-EV-028Amazon Web Services (ap-south-1) · screenshot (Q2)BCP-01Amazon Web Services (ap-south-1)23 Jun 2026Accepted
Q2-EV-029Microsoft Azure (corporate) · system export (Q2)BCP-01Microsoft Azure (corporate)4 Jun 2026Accepted
RBI-REQ-025AWS: Portal DB restore test reportBCP-014 Oct 2026Accepted
RBI-REQ-026Microsoft Azure: SAP HANA restore test reportBCP-019 Oct 2026Accepted
SOC2-REQ-033AWS: Portal DB restore test reportBCP-019 Oct 2026Under review

Tests (3)

Open list →
TestControlCycleTestedByResultConfidence
TST-ISO-BCP-01BCP-01 · Backup restore and DR are testedQ3 2026 Unified Program Review7 Oct 2026Suresh Pillai · Northgate Certification ServicesPassHigh
TST-RBI-BCP-01BCP-01 · Backup restore and DR are testedQ3 2026 Unified Program Review1 Oct 2026Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell)PassHigh
TST-Q2-BCP-01BCP-01 · Backup restore and DR are testedQ2 2026 Unified Program Review20 Jun 2026Farah Khan, Vikram Mehta · Meridian Internal AuditPass with ObservationMedium