Protect backups against intentional and unintentional deletion, manipulation and reading. a) Backup copies should be kept separate from the organisation’s production environment. See e.g. principle 2.1 – “Maintain security during procurement and development processes”. b) Access rights to backup copies should be restricted to only employees and system processes involved in restoring data. c) Offline backups which are inaccessible through the organisation’s networks should be created regularly. This is in order to prevent intentional/unintentional deletion and manipulation. d) Backups should be protected with encryption when being stored or moved over the network. This includes external security backups and cloud services.