Backup Controls

7/25/2019 Backup Controls

1/12

Aira VicencioMarian Samiley

Backup Controls


2/12

A backup is a duplicate of a file

Backup is the activity of copying files or databases so that thebe preserved in case of equipment failure or other catastroph

Controls provide reasonable assurance that data is backed upmanagement procedures are appropriate.

Backup Controls


3/12

Controls may not provide reasonable assurance that data is backed u

that data management procedures are appropriate. If controls relatindata backup and management are not adequate, it increases the risk

(1) Historical records may be unavailable or inaccurate;

(2) IS&T personnel may not be able to restore and recover systems in event of an operating incident or erroneous processing;

(3) The procedures that are followed to archive data may not satisfy lregulatory requirements; and,

(4) The procedures followed to manage and control data backups mainferior to controls for on-line data leading to sensitive data being dalost, modified or inappropriately disclosed.


4/12

The backup technique to be employed in an organization isdependent on the media and file structure.

1.Grandparent-Parent-Child (GPC) Backup

2.Direct Access File Backup

3.Off-site Storage

Backup Options/Techniques


5/12

Used in the case of sequential file batch system

The backup procedure begins, when the current master file parent), is processed against the transaction file, to produce updated master (child).

With the next batch of transaction, the child becomes the pa

(current master file) and the parent becomes the backup(grandparent). The new master file that is updated, becomechild.

This procedure continues, with each new batch of transactiocreating a series or generations of backup files.

Grandparent-Parent-Child (GPC) Back


6/12

When the desired number of backup copies is reached, the obackup is erased. In this case, if the current master file is delethen the same can be processed from the current transaction

Number of backup files needed for each application is depedtwo factors

1) the relative sensitivity or importance of the application to

organization

2) The degree file activity (the number of times the master file updated)


7/12

Data values in direct access files are changed in place througprocess calleddestructive replacement

Once a data value is changed, the original value is destroyed only one version (the current version) of the file. To provide bdirect access files must be copied before being updated.

Real-time systems use timed backup. Transactions processed

between backup runs will need to be reprocessed after restorof the master file.

In a batch processing system using direct access files, the mais backed up before the update run.

Direct Access File Backup


8/12

The time of direct access back up will depend on the processmethod being used.

If the current version of the master file is destroyed through afailure or corrupted by a program error, it can be recontstrucwith a specila recovery program from the most current backu


9/12

As an added safeguard, backup files created under both the and direct access approached should be stored off-site in a selocation.

Of-site tora!e


10/12

Verify that backup controls in place are effective in protectingfiles from physical damage, loss, accidental erasure, and datacorruption through system failures and program errors.

Audit O"#ecti$e %elatin! to Flat&'leBackup


11/12

Sequential File (GFC) Backup.The auditor should select a sa

o f systems and determine from the system documentation thnumber of GFC backup files specified for each system is adequIf insufficient backup versions exist, recovery from some typesfailures may be impossible.

Backup Transaction Files.The auditor should verify throughphysical observation that transaction files used to reconstruct

master files are also retained. Without corresponding transactfiles, reconstruction is impossible.

Audit Procedures or Testin! Flat-'leBackup Controls


12/12

Direct Access File Backup.The auditor should select a samp

applications and identify the direct access files being updatedeach system. From system documentation and through obserthe auditor can verify that each of them was copied to tape o

before being updated.

Off-Site Storage.The auditor should verify the existence andadequacy of off-site storage. This audit procedure may beperformed as part of the review of the disaster recovery plancomputer center operations control.

Backup Controls

Documents