ISO 27001: evidence for control A.8.13

ISO/IEC 27001:2022 Annex A control 8.13 Information backup asks that backup copies be maintained and regularly tested in line with an agreed backup policy. A certification auditor will ask how you test them, how often, and what the last results were.

What Verestore gives your auditor

• Regular restore tests. Daily, weekly or monthly, of your newest PostgreSQL backup, into a disposable database that's deleted when the run ends.
• What was checked. Every table restored, row counts against the previous run, checksums of the tables you choose, and your own SQL checks against a baseline.
• Evidence you can't edit. Each result is signed by the run and countersigned by Verestore. Anyone can check a report at /verify.
• An evidence pack per period. A ZIP with the reports, the signed results and a summary for the audit window, plus the coverage sentence on every target.

How to use it in your ISMS

1. In your backup policy, state the restore-test frequency and what a passing test means (for example: all tables present, row counts within 25%, the custom checks pass).
2. Connect the backup location with a read-only key (how access works) and set the schedule to match the policy.
3. In your Statement of Applicability, reference the Verestore targets as the testing evidence for A.8.13; attach the evidence pack for the audit period.

Verestore produces evidence for this control; it doesn't certify your organisation. Your auditor decides what is sufficient.