Body
Saint Peter’s University is committed to protecting institutional data and maintaining operational continuity through effective backup and recovery practices. To support these objectives, the University has established this Server Backup and Restore Testing Policy to define the standards, procedures, and oversight required to ensure backup and recovery processes are functioning as intended. This policy establishes requirements for regularly testing restore functionality, periodically auditing backup coverage, documenting technical procedures used to validate backup and recovery operations, and maintaining evidence of compliance with these requirements. The overall goal of this policy is to strengthen the University’s ability to recover systems and data in a reliable, timely, and verifiable manner in the event of data loss, system failure, cybersecurity incidents, or other disruptions.
Policy Requirements
-
Restore Testing Frequency: On no less than a quarterly basis the Systems Administrator shall choose a random VM in the datacenter to perform a restore test on. This test shall cover either full vm recovery or target specific files for recovery. Ideally both will be tested each time, however at a minimum these two methods should be alternated between tests. The recovery point chosen for the test restore will be any recover point that is at least 15 days old at the time of the test but no older than 45 days old. The schedule for testing shall be created by the Systems Administrator on a yearly basis and communicated with the Technical Director and/or the CIO .
-
Backup Audit Frequency: As part of these scheduled tasks, the systems administrator shall also validate backup coverage. This means that an inventory of all virtual machines shall be compared with the inventory of machines being backed up and a list of the systems that are not included for backup shall be documented. Each non-backed up system shall have a justification provided for why it is not being backed up
-
Technical Procedures: The Systems Administrator shall utilize the backup and restore documentation that they created previously to perform their test restore. When testing full vm recovery they will ensure that the restored virtual machine is brought up with the network disconnected to ensure that they do not impact the production systems. Ideally, they will test both file recovery and full vm recovery, however at a minimum they will alternate between testing each method and additionally, document the method and results in the resulting ticket.
-
Evidence Recording Process: During each schedule recovery testing period the Systems administrator shall create a ticket with a subject of “Backup Recovery Testing – mm/dd/yyyy”. In this ticket they will document the type of recovery(ies), the vm(s) selected for testing and the results of the test whether successful or failed. In addition, they will include the list of machines that are not currently being backed up with their justification statements in the same ticket.
Adopted 06/22/2026