PR.DS-11: Backups of data are created, protected, maintained, and tested

Threats Addressed:

Info icon.

Subcategory is new to this version of the framework and incorporates the following item from the previous version: PR.IP-4: Backups of information are conducted, maintained, and tested.

Description

[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]

Implementation Examples

1st: 1st Party Risk

Ex1: Continuously back up critical data in near-real-time, and back up other data frequently at agreed-upon schedules

Ex2: Test backups and restores for all types of data sources at least annually

Ex3: Securely store some backups offline and offsite so that an incident or disaster will not damage them

Ex4: Enforce geographic separation and geolocation restrictions for data backup storage

Related Controls

NIST Special Publication 800-53 Revision 5.2.0

CP-6: Alternate Storage Site

Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and Ensure that the alternate storage site provides controls equivalent to that of the primary site.

CP-9: System Backup

Conduct backups of user-level information contained in [Assignment: organization-defined system components] [Assignment: organization-defined frequency]; Conduct backups of system-level information contained in the system [Assignment: organization-defined frequency]; Conduct backups of system documentation, including security- and privacy-related documentation [Assignment: organization-defined frequency] ; and Protect the confidentiality, integrity, and availability of backup information.

NIST SP 800-171 Revision 3.0

Cloud Controls Matrix v4.0

BCR-08: Backup

Periodically backup data stored in the cloud. Ensure the confidentiality, integrity and availability of the backup, and verify data restoration from backup for resiliency.

CEK-18: Key Archival

Define, implement and evaluate processes, procedures and technical measures to manage archived keys in a secure repository requiring least privilege access, which include provisions for legal and regulatory requirements.

DSP-19: Data Location

Define and implement, processes, procedures and technical measures to specify and document the physical locations of data, including any locations in which data is processed or backed up.

LOG-02: Audit Logs Protection

Define, implement and evaluate processes, procedures and technical measures to ensure the security and retention of audit logs.

LOG-09: Log Protection

The information system protects audit records from unauthorized access, modification, and deletion.

Critical Security Controls Version 8.1

11.2: Perform Automated Backups

Perform automated backups of in-scope enterprise assets. Run backups weekly, or more frequently, based on the sensitivity of the data.

11.3: Protect Recovery Data

Protect recovery data with equivalent controls to the original data. Reference encryption or data separation, based on requirements.

11.5: Test Data Recovery

Test backup recovery quarterly, or more frequently, for a sampling of in-scope enterprise assets.