Auditing Disaster Recovery Management - Auditing Information Systems: Enhancing Performance of the Enterprise - page 125

information on backup processes can be collected from reports generated by the backup
software or documents produced by backup operators.
Most online backup systems have inbuilt library controls which ensure that all backups are
coded and documented. After each backup, the system will produce a report. A sample re-
port is indicated below.

# Description Output Information

1 Backup Date 12-03-2014

2 Backup Time 09.30

3 Backup Type Incremental

4 Data Origin //Server01/data1

5 Backup Target //server03/data1

6 Backup Completion Time 02.20

Figure 9.2 Backup Report
Most enterprises have off-site storage facilities where data is backed up. The off-site stor-
age facilities are connected to the main office via networks using fibre, satellite, leased
lines or wireless connections.
Off-site storage facilities should be secured so that unauthorized people do not gain access
and tamper with data stored at the facilities. There are various security controls which can
be implemented in order to ensure appropriate security at off-site storage sites.
Access to off-site storage facilities should be restricted to only authorised users with spe-
cific responsibilities at the off-site facilities. The authorization should be granted by man-
agement and regularly reviewed to ensure that access permissions to processing systems
are appropriate. Access to the facility includes permission to physical security officers and
those required to access and use the systems. Physical access controls can be implemented
using swipe cards which are configured with appropriate access permissions. The enter-
prise can also consider use of different technologies such as biometric access pads which
make use of fingerprints or eye retina.
Environmental controls are important as they ensure protection of systems and data from
environmental hazards such as humidity, water, fire, heat, and power surges. The enterprise
should provide the same environmental controls as those at the main data centre. The enter-
prise can, for example, install fire control systems at the off-site storage in order to protect
the facility from fire hazards. Fire systems can range from the use of simple handheld fire