Key takeaways
- Build in enough redundancy to meet availability needs.
- Redundancy keeps critical services running when a component fails.
- Start here: identify systems that need high availability.
Purpose
Build in enough redundancy to meet availability needs.
Requirement
Requirement summaryInformation processing facilities shall be implemented with redundancy sufficient to meet availability requirements.
Why it matters
Redundancy keeps critical services running when a component fails.
How to implement
- Identify systems that need high availability.
- Build in redundancy such as multiple zones or failover.
- Test failover.
- Monitor redundant components so failures are noticed.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.14. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your requirements for keeping key systems available, including backup systems (redundancy).
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.14 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A diagram or description showing backup systems for critical services.
- Failover test results.
- Uptime or availability reports.
Things you should be able to show or explain
- IT should be able to explain how they know redundancy is working.
How much to show: Two or three critical services.
Common mistakes
- Single points of failure.
- Failover never tested.
- Redundancy configured but never tested.
- Single points of failure in DNS or identity.
- Tip: Multi-zone deployment for critical services.
Policies & documents to have
- Business Continuity and Disaster Recovery Plan
- Operations Security Policy
FAQ
Is A.8.14 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.14?
Be ready to explain how the control works in your organisation and to provide things like: Your requirements for keeping key systems available, including backup systems (redundancy)…