Edit: Availability/Disaster Recovery is an important factor in security, so how isn't it import who executes backups and when? Edit: Please cite sources. Some of these questions are very odd. This question should be more specific, because if you consider a backup as "where my info is going to".... changes the real dimension of the context. **The policy doesn't need to specify who/when will backup, only that a backup is needed at a set interval or an end result.