Title

There are no procedures for the backup and recovery of the ESX Server, management servers, and virtual machines. (Cat III impact)

Discussion

Backup and recovery procedures are critical to the availability and protection of the virtual infrastructure. Availability of the system will be hindered if the system is compromised, shutdown, or not available. Backup and recovery of the virtual environment includes the ESX Servers, management servers, and virtual machines. The ESX Server has three major components required for backup and recovery. These components are virtual disks, virtual machine configuration files, and the configuration of the ESX Server itself. Due to the array of products and options available to backup the virtualization infrastructure, procedures will need to be developed to provide guidance to system administrators.

Check Content

Request a copy of the backup and recovery procedures for the ESX Servers, management applications, and virtual machines. If no procedures can be produced or they are incomplete, this is a finding.

Fix Text

Develop backup and recovery procedures for the virtual infrastructure.

Additional Identifiers

Rule ID: SV-16792r1_rule

Vulnerability ID: V-15851

Group Title: Backup and recovery procedures don't exist

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.