Why it matters
The most fundamental control against data loss — and the one most often assumed rather than verified.
How a self-led small team implements it
Automated backups plus a tested, logged restore at least annually — untested backups don't count as evidence.
What auditors expect to see
Backup schedule, restore test log.
Track A.8.13 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS