Finding · F-ISO-01
SAP HANA restore test exceeded RTO (internal ISMS audit, carried into surveillance)
ClosedBCP-01 · Backup restore and DR are testedOperations & ResilienceQ3 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low
Requirement to validation
Requirement
ISO-A.5.30 · ISO-A.8.13 · ITGC-OP-01 · RBI-ITGRCA-2023-8 · SOC2-A1.2 · SOC2-A1.3
mapped
Policy
Business Continuity & Backup Policy
pol-bcp
Control
BCP-01
Backup restore and DR are tested
Application
Amazon Web Services (ap-south-1) · Microsoft Azure (corporate)
mapped
Evidence · Q3
6 items
4 approved · 2 pending · 0 rejected
Test · Q3
Pass
TST-ISO-BCP-01 · High confidence
Finding
F-ISO-01 · Medium
Closed
Action
Rahul Nair
REM-F-ISO-01 · Closed
Validation
Validated
as recorded
Observation
Raised 2026-09-16 in the ISO/IEC 27001:2022 Surveillance Audit — 2026 (Northgate Certification Services). Classified as a minor nonconformity. SAP HANA restore test exceeded RTO (internal ISMS audit, carried into surveillance).
Applications: Amazon Web Services (ap-south-1), Microsoft Azure (corporate).
Potential risk
The control may not operate consistently, weakening reliance by auditors and the regulator.
Root cause
Restore runbook restored logs serially and the DR instance was undersized.
Agreed action plan
Restore runbook revised (parallel log restore), DR instance resized; retest on 2026-10-07 completed in 3h10m within 4h RTO.
Management response: Restore runbook revised (parallel log restore), DR instance resized; retest on 2026-10-07 completed in 3h10m within 4h RTO.
- Action
- REM-F-ISO-01
- Owner (FPR)
- Rahul Nair
- Target date
- 16 Oct 2026
- Priority
- Medium
- Status
- Closed
- Validation
- Validated · planned 7 Oct 2026
Evidence for this control (8)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ISO-REQ-020 | AWS: Portal DB restore test report | BCP-01 | 8 Oct 2026 | Accepted | |
| ISO-REQ-021 | Microsoft Azure: SAP HANA restore test report | BCP-01 | 7 Oct 2026 | Accepted | |
| ITGC-REQ-029 | AWS: Portal DB restore test report | BCP-01 | 9 Oct 2026 | Under review | |
| Q2-EV-028 | Amazon Web Services (ap-south-1) · screenshot (Q2) | BCP-01 | Amazon Web Services (ap-south-1) | 23 Jun 2026 | Accepted |
| Q2-EV-029 | Microsoft Azure (corporate) · system export (Q2) | BCP-01 | Microsoft Azure (corporate) | 4 Jun 2026 | Accepted |
| RBI-REQ-025 | AWS: Portal DB restore test report | BCP-01 | 4 Oct 2026 | Accepted | |
| RBI-REQ-026 | Microsoft Azure: SAP HANA restore test report | BCP-01 | 9 Oct 2026 | Accepted | |
| SOC2-REQ-033 | AWS: Portal DB restore test report | BCP-01 | 9 Oct 2026 | Under review |
Tests of this control (3)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-ISO-BCP-01 | BCP-01 · Backup restore and DR are tested | Q3 2026 Unified Program Review | 7 Oct 2026 | Suresh Pillai · Northgate Certification Services | Pass | High |
| TST-RBI-BCP-01 | BCP-01 · Backup restore and DR are tested | Q3 2026 Unified Program Review | 1 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell) | Pass | High |
| TST-Q2-BCP-01 | BCP-01 · Backup restore and DR are tested | Q2 2026 Unified Program Review | 20 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Pass with Observation | Medium |