CIS Controls v8 CIS-11.5: Test Data Recovery

What else in your programme already covers this

This control maps to 65 controls across 26 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 7 controls

CP-10 System Recovery and Reconstitution
CP-10(2) System Recovery and Reconstitution | Transaction Recovery (CP-10(2))
CP-2 Contingency Plan
CP-2(3) Resume Mission and Business Functions
CP-4 Contingency Plan Testing
CP-9 System Backup
CP-9(1) Testing for Reliability and Integrity

FedRAMP Moderate · 7 controls

CP-10 System Recovery and Reconstitution
CP-10(2) System Recovery and Reconstitution | Transaction Recovery (CP-10(2))
CP-2 Contingency Plan
CP-2(3) Resume Mission and Business Functions
CP-4 Contingency Plan Testing
CP-9 System Backup
CP-9(1) Testing for Reliability and Integrity

NIST SP 800-53 Rev 5 · 6 controls

NIST800-CP-1 CP-1 Policy and Procedures
NIST800-CP-10 CP-10 System Recovery and Reconstitution
NIST800-CP-2 CP-2 Contingency Plan
NIST800-CP-4 CP-4 Contingency Plan Testing
NIST800-CP-9 CP-9 System Backup
SP800-53-CP Contingency Planning Family

NIST Cybersecurity Framework 2.0 · 4 controls

NIST-CSF-PR.DS-11 Backups of data are created, protected, maintained, and tested
NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
NIST-CSF-RC.RP-03 The integrity of backups and other restoration assets is verified before using them for restoration
NIST-CSF-RC.RP-05 The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

CCM-BCR-06 Business Continuity Exercises
CCM-BCR-08 Backup
CCM-BCR-10 Response Plan Exercise

HIPAA Security Rule · 3 controls

164.308(a)(7)(ii)(A) Data Backup Plan (Required)
164.308(a)(7)(ii)(B) Disaster Recovery Plan (Required)
164.308(a)(7)(ii)(D) Testing and Revision Procedures (Addressable)

ISO 22301:2019 · 3 controls

8.4.5 Recovery
8.5 Exercise programme
8.6 Evaluation of business continuity documentation and capabilities

ISO 27001:2022 · 3 controls

5.29 Information security during disruption
5.30 ICT readiness for business continuity
8.13 Information backup

ISO 27701:2019 · 3 controls

6.14 Information security aspects of business continuity management
6.14.1 Information security continuity
6.9.3 Backup

NIST SP 800-66 Rev 2 · 3 controls

164.308(a)(7)(ii)(A) Data Backup Plan (Required)
164.308(a)(7)(ii)(B) Disaster Recovery Plan (Required)
164.308(a)(7)(ii)(D) Testing and Revision Procedures (Addressable)

SOC 2 · 3 controls

SOC2-A1.2 A1.2 Environmental protection, backup and recovery infrastructure
SOC2-A1.3 A1.3 Testing recovery plan procedures
SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

ASD37-34 Regular backups (Essential)
ASD37-35 Business continuity and disaster recovery plans (Very Good)

C5 (Germany) · 2 controls

C5-BCM-04 Verification, updating and testing of the business continuity
C5-OPS-08 Data Backup and Recovery - Regular Testing

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 2 controls

CFTC-SS-11 Testing and Review of Business Continuity and Disaster Recovery Capabilities
CFTC-SS-22 Business Continuity and Disaster Recovery Planning Category

DORA · 2 controls

DORA-Art.11 Response and recovery
DORA-Art.12 Backup policies and procedures, restoration and recovery

ISO 27002:2022 · 2 controls

5.30 ICT readiness for business continuity
8.13 Information backup

ACSC Essential Eight · 1 control

E8-BACKUP-ML1 Regular Backups (ML1)

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-37 Define and Apply a Backup Policy for Critical Components

APRA CPS 230 Operational Risk Management · 1 control

CPS230-33 Systematic BCP Testing Program

APRA CPS 234 · 1 control

CPS234-32 Annual Review and Testing of Response Plans

Australian Information Security Manual · 1 control

ISM-1515 Testing restoration to a common point

Azure Security Benchmark · 1 control

ASBv3-BR-4 Regularly test backup

CMMC 2.0 · 1 control

MP.L2-3.8.9 Protect Backups

NIS2 Directive · 1 control

Art.21.2.c Business continuity, backup management, disaster recovery and crisis management

NIST SP 800-161 Rev 1 · 1 control

161R1-CP-4 Contingency Plan Testing

PCI DSS 4.0 · 1 control

12.3.1 12.3.1 Targeted risk analysis for flexible-frequency requirements

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of CIS Controls v8 have you already done?

CIS Controls v8 CIS-11.5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CIS Controls v8 your existing evidence covers. Hold ISO 27001:2022 and 102 of 153 CIS Controls v8 controls already carry evidence.

If you hold ISO 27001:202266.7% covered · 51 gaps If you hold FedRAMP Moderate62.7% covered · 57 gaps If you hold NIST SP 800-53 Rev 557.5% covered · 65 gaps If you hold NIST Cybersecurity Framework 2.050.3% covered · 76 gaps If you hold ISO 27002:202249.7% covered · 77 gaps If you hold Azure Security Benchmark49% covered · 78 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 240 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free