Objective
Ensure Odoo backups remain in an approved secure location with restricted access, auditable retention and controlled disposal.
Verification Requirements
The control must verify:
- Storage location: backups are stored only within the approved SharePoint location:
Bitkaya Compliance / offsite Backups (Bitkaya) / Odoo (Bitkaya). - SharePoint rationale: existing enterprise infrastructure, strong access control and audit logging, integration with internal workflows, geographic redundancy.
- Security controls: access control via role-based permissions, audit logging and monitoring, secure transmission (HTTPS). Given these controls, additional encryption of backup files is not required under this policy.
- Access restriction: access to backup files remains restricted to authorized personnel. Backup files are not distributed outside the controlled environment.
- Microsoft 365 internal access control policies are followed.
- Retention: monthly backups retained for a minimum of 12 months; extended retention may apply based on regulatory requirements; older backups may be archived or securely deleted.
Control Activity
Technology and Compliance review the approved SharePoint location, access rights, security controls and retention status quarterly and authorize archival or disposal.
Evidence
- Expected evidence: Approved storage path and configuration
- Expected evidence: Access approvals and quarterly review
- Expected evidence: Audit logs and security evidence
- Expected evidence: Retention, holds, archival and deletion evidence
- Evidence location: source evidence in SYS-ECM-002 Compliance Reporting and Evidence Repository, SYS-OUT-001 Outsourcing Register; target Hermes assessment record in Odoo under ISS-HERMES-001.
- Retention: according to the applicable approved policy and Bitkaya record-retention requirements.
- Testing method: sample backups and users for approved location, authorized access, logging, retention and defensible disposal
- Testing frequency: quarterly
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: documented; storage-path and encryption conflicts pending
History
- 2026-07-26: Normalized evidence metadata and separated design status from runtime effectiveness.