Skip to content

Backup Policy

Controls: A.8.13 · Owner: Thomas Picauly · Applies to: all production data (AWS RDS MySQL, eu-west-1) · Review: annual

Why: so we can recover customer data and the platform after loss, corruption or ransomware (risk R-15).

Rules — these must always be true

  • The production database rds-soon-soon-prod has automated snapshots enabled (confirmed by Melvin 2026-07-04; re-verified automatically 2026-08-08 — retention 7 days, storage encrypted). Manual mysqldump runs are also taken in addition. (Q5)
  • Point-in-time recovery is enabled on production RDS. Currently NOT enabled — only daily snapshots (confirmed 2026-07-04). Action: enable PITR on both instances (see R-15 / Risk Treatment Plan).
  • Backups are encrypted at rest — both RDS instances have AWS KMS storage encryption on (confirmed 2026-07-04).
  • Backups are stored in the cloud / a separate account, never only on personal laptops. (finding: 2023 dumps were stored locally — fix.) Current state (2026-07-04): RDS snapshots live in the same AWS account and same region (eu-west-1) as the source DB — a compromise of that account, or ransomware within it, could destroy both prod and backups. Action: copy snapshots to a separate AWS account / backup vault (see R-15 treatment).
  • A restore is tested at least quarterly and the result recorded (monitoring metric M8). Never tested end-to-end as of 2026-07-04 — first drill to be scheduled (owner: Melvin).
  • Backups are retained per the retention schedule. Decision 2026-08-13 (Olaf): raise production retention from 7 to 30 days. Rationale: corruption discovered after day 7 would otherwise be unrecoverable, and 30 days is the common audit expectation. RDS includes backup storage up to 100% of provisioned DB storage at no charge, so the cost impact is expected to be negligible. Applied 2026-08-13: rds-soon-soon-prod retention is now 30 days (verified; no downtime). Evidence captured (describe-db-instances, SHA-256 86b76bdc…) for the S3 store under A.8.13.
  • Access to backups is least-privilege and MFA-protected.
  • Former-client data (Knab) — the dedicated instance no longer exists (verified 2026-08-08); residual teardown tracked in Linear S-354.

How we prove it (evidence)

  • Automated snapshots → verified 2026-08-13 via rds:DescribeDBInstances: prod 30-day retention, dev 7-day. Automated check CHK-BACKUP-01 re-verifies daily.
  • PITR → not currently enabled (2026-07-04); evidence to be re-captured once turned on.
  • Encryption at rest → verified 2026-08-13: StorageEncrypted = true on both instances (KMS). Automated check CHK-ENC-01.
  • Restore test → no dated restore-test record yet — first drill to be scheduled by Melvin.
  • Retention → retention setting (7 d production) + Records Retention Policy.

If a rule isn't true

Raise it as a nonconformity (ISMS-DOC-10-1) or risk (R-15), assign an owner, fix it.

Checklist policy (pilot of the short format). Backups depend on infra owned by the Technical Lead; this list is what we keep true and prove. Change log: v0.2 (2026-06-25) rewritten from template into checklist format with real AWS RDS facts.