Templates and records · ISO 27001 · Clause A.5.30 y A.8.13

Record of continuity tests and backup restores

Proof that backups can be restored and that services recover within the committed time, not merely that a plan exists.

In one sentence

The record of continuity and backup tests documents what was tested, against which recovery time objective, what result was obtained and what was fixed; it is the evidence for control 5.30, which requires ICT readiness for business continuity to be planned, implemented, maintained and tested, and for control 8.13, which requires backups to be tested regularly.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 27001 · Clause A.5.30 y A.8.13 Clauses follow ISO/IEC 27001:2022; those beginning with “A.” are Annex A controls, required to the extent that the statement of applicability includes them.
Type of information: Good practice Evidence for Annex A controls 5.30 and 8.13
Who fills it in: IT manager The service owner confirms that the result meets their objectives
When: According to the test plan Backup restores more frequently; full failover tests at least once a year
How long it is kept: Set by the organisation ISO/IEC 27001 sets no periods: it asks you to decide on the retention and disposition of documented information (7.5.3). Covering the three-year certification cycle lets you show the history at recertification.

What the standard requires

What ISO 27001 demands and what it leaves to your judgement

Control 5.30, new in the 2022 edition, requires ICT readiness for business continuity to be planned, implemented, maintained and tested against business continuity objectives. Control 8.13 requires backup copies of information, software and systems to be maintained and tested regularly.

A continuity plan that has never been tested is a hypothesis. What the auditor asks for is the result of the last test and what changed afterwards.

The standard does not specify the type or frequency of testing; ISO 22301 is the reference if you want a full business continuity system.

Read it in context: Operation, in the ISO 27001 Academy

Structure

Fields the template should include

Service or system tested and type of test (restore, failover, tabletop exercise)
Objective: acceptable recovery time and recovery point
Date, participants and scenario
Result measured against the objective
Issues found during the test
Improvement actions, owner and deadline
Conclusion: passed or failed

Example

Example: restoring the production database

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Test	Full restore of the platform database in an isolated environment
Objective	Recover in under 4 hours with a maximum loss of 24 hours of data
Date and participants	21 May 2026 · head of infrastructure and two technicians
Result	Restored in 5 h 10 min · data intact up to the 02:00 backup
Issue	The procedure did not cover regenerating the encryption keys
Action	Update the procedure and repeat the test · 30 June
Conclusion	Failed · repeated on 26 June: 3 h 20 min, passed

At the audit

Mistakes auditors commonly flag

Checking that the backup “completed successfully”, never that it can be restored.
No recovery objectives to compare the result against.
Failed tests are not recorded or do not lead to actions.
The continuity plan has not been updated after a change of cloud provider.

In Kimobox

How this record is kept in Kimobox

1Recovery tests and continuity plans are documented on the platform.
2The continuity plan is a versioned record, and each test links to the actions it generates.
3Resulting actions are assigned with an owner and a date, with an alert if they slip.

Frequently asked questions

What people ask us before getting started

Do I need ISO 22301 certification?

No. ISO/IEC 27001 requires ICT readiness for business continuity, not a full business continuity management system. ISO 22301 is useful as guidance, but it is not a requirement.

Does a tabletop exercise count?

As part of the test plan, yes: it validates roles and communication. But it is no substitute for actually restoring backups, which is what demonstrates control 8.13.

Keep your ISO 27001 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

ISO/IEC 27001:2022 — Information security management systems. Requirements ISO/IEC · 25 October 2022
ISO/IEC 27002:2022 — Information security controls ISO/IEC · February 2022