Glossary · OT cybersecurity
Backup and recovery
Also known as: Backup and restore
German: Datensicherung und Wiederherstellung
In industrial automation, backup and recovery is the practice of creating protected copies of control programs, configurations, recipes and system images and of restoring a system from them after failure, corruption or a cyberattack. It covers what is backed up, how often, where copies are stored and how restores are tested.
- OT security
In one sentence
Backup and recovery protects PLC programs, configurations and system images and restores them after failure, corruption or a cyberattack.
Example
Each night, the plant's backup server collects the current PLC projects, drive parameters and HMI configurations and keeps an offline copy that ransomware on the office network cannot reach.
How it applies
- Engineering: Scope includes PLC and safety controller programs, drive and robot parameters, HMI and SCADA projects, network device configurations and operating system images of industrial PCs. At least one copy should be kept offline or immutable so that an attack cannot encrypt it together with the plant.
- Operation: Backups are only useful if they match the running state. Tie them to Change control so that every approved change creates a new, labeled backup.
- Maintenance: Restores must be tested regularly (see Backup restore); an untested backup may be incomplete or unreadable with the current engineering software version.
- Documentation: Service and maintenance manuals should explain which data a component holds, how to back it up and restore it, which software versions are required, and what must be checked after a restore, including safety-related parameters and checksums.
Backup and recovery vs. disaster recovery
Backup and recovery is about data and configurations of individual systems. Disaster recovery is the planned restoration of whole services or sites after a major event and uses backups as one input.