Control · OPS-01
Backups are performed daily and monitored
Operations & ResilienceSOC 2 · ISO 27001 · ITGC · RBIRisk Medium
Requirement to validation
Requirement
ISO-A.8.13 · ITGC-OP-01 · RBI-ITGRCA-2023-8 · SOC2-A1.2
mapped
Policy
Business Continuity & Backup Policy
pol-bcp
Control
OPS-01
Backups are performed daily and monitored
Application
Amazon Web Services (ap-south-1) · Microsoft Azure (corporate)
mapped
Evidence · Q3
6 items
6 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-RBI-OPS-01 · High confidence
Finding
F-IAQ2-OPS-01 · Medium
Closed
Action
Rahul Nair
REM-F-IAQ2-OPS-01 · Closed
Validation
Validated
as recorded
What should be true
Production databases (Customer Portal RDS, payment ledger) and SAP HANA are backed up daily with encryption and cross-region copy; failed jobs are alerted and rerun within 24 hours.
- Requirements
- ISO-A.8.13 A.8.13 · Information backupITGC-OP-01 ITGC-OP-01 · Backups are performed, monitored and restorableRBI-ITGRCA-2023-8 RBI-ITGRCA-2023 §8 · Business continuity and DR — backup, restoration testing and DR drills (RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023)SOC2-A1.2 A1.2 · Environmental protections, backup and recovery infrastructure
- Third parties
- Amazon Web Services (AWS India)
- Testing procedure
- AWS Backup plans + Azure Backup; alerts to IT Ops on-call. Tests: Amazon Web Services (ap-south-1): AWS Backup jobs succeeded in last 24h; Microsoft Azure (corporate): Azure Recovery Services vault jobs succeeded. Frequency daily.
Findings (1)
| Finding | Observation | Control | Applications | Severity | Status | Owner | Action | Validation |
|---|---|---|---|---|---|---|---|---|
| F-IAQ2-OPS-01 | Failed backup jobs not followed up | OPS-01 | Amazon Web Services (ap-south-1), Microsoft Azure (corporate) | Medium | Closed | Rahul Nair | REM-F-IAQ2-OPS-01 · Closed | Validated |
Evidence (8)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ITGC-REQ-027 | AWS: AWS Backup jobs succeeded in last 24h | OPS-01 | 4 Oct 2026 | Accepted | |
| ITGC-REQ-028 | Microsoft Azure: Azure Recovery Services vault jobs succeeded | OPS-01 | 9 Oct 2026 | Accepted | |
| Q2-EV-026 | Amazon Web Services (ap-south-1) · policy document (Q2) | OPS-01 | Amazon Web Services (ap-south-1) | 13 Jun 2026 | Accepted |
| Q2-EV-027 | Microsoft Azure (corporate) · screenshot (Q2) | OPS-01 | Microsoft Azure (corporate) | 18 Jun 2026 | Rejected |
| RBI-REQ-023 | AWS: AWS Backup jobs succeeded in last 24h | OPS-01 | 5 Oct 2026 | Accepted | |
| RBI-REQ-024 | Microsoft Azure: Azure Recovery Services vault jobs succeeded | OPS-01 | 4 Oct 2026 | Accepted | |
| SOC2-REQ-031 | AWS: AWS Backup jobs succeeded in last 24h | OPS-01 | 4 Oct 2026 | Accepted | |
| SOC2-REQ-032 | Microsoft Azure: Azure Recovery Services vault jobs succeeded | OPS-01 | 9 Oct 2026 | Accepted |
Tests (4)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-RBI-OPS-01 | OPS-01 · Backups are performed daily and monitored | Q3 2026 Unified Program Review | 7 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell) | Pass | High |
| TST-ITGC-OPS-01 | OPS-01 · Backups are performed daily and monitored | Q3 2026 Unified Program Review | 4 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit | Pass | High |
| TST-SOC2-OPS-01 | OPS-01 · Backups are performed daily and monitored | Q3 2026 Unified Program Review | 3 Oct 2026 | Laura Bennett · Kestrel Assurance LLP | Pass | High |
| TST-Q2-OPS-01 | OPS-01 · Backups are performed daily and monitored | Q2 2026 Unified Program Review | 18 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Fail | High |