ISO 27701:2019 6.9.3: Backup

What else in your programme already covers this

This control maps to 55 controls across 22 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 19011:2018 · 6 controls

5.5.4 Selecting audit team members
6.4.3 Conducting opening meeting
6.5.2 Distributing audit report
6.7 Conducting audit follow-up
7.2.3 Knowledge and skills
7.2.4 Achieving auditor competence

CIS Controls v8 · 5 controls

CIS-11.1 Establish and Maintain a Data Recovery Process
CIS-11.2 Perform Automated Backups
CIS-11.3 Protect Recovery Data
CIS-11.4 Establish and Maintain an Isolated Instance of Recovery Data
CIS-11.5 Test Data Recovery

Azure Security Benchmark · 4 controls

ASBv3-BR-3 Monitor backups
ASBv3-BR-4 Regularly test backup
BR-1 Ensure regular automated backups
BR-2 Protect backup and recovery data

PCI DSS 4.0 · 4 controls

10.3.3 Logs backed up to central server
12.3.1 Targeted risk analysis documented for requirements that specify one
9.4.1.1 Offline media backup security
9.4.1.2 Offsite backup location reviewed

FedRAMP High · 3 controls

CP-10 System Recovery and Reconstitution
CP-9 System Backup
CP-9(1) Testing for Reliability and Integrity

FedRAMP Moderate · 3 controls

CP-10 System Recovery and Reconstitution
CP-9 System Backup
CP-9(1) Testing for Reliability and Integrity

NIST SP 800-53 Rev 5 · 3 controls

NIST800-CP-9 System backup
NIST800-SC-28 Protection of information at rest
SP800-53-CP Contingency Planning Family

NIST SP 800-53 Rev 5 MODERATE · 3 controls

CP-10 System Recovery and Reconstitution
CP-9 System Backup
CP-9(1) Testing for Reliability and Integrity

NIST SP 800-53 Revision 5.1 HIGH · 3 controls

CP-10 System Recovery and Reconstitution
CP-9 System Backup
CP-9(1) Testing for Reliability and Integrity

C5 (Germany) · 2 controls

C5-OPS-06 Data Backup and Recovery - Concept
C5-OPS-08 Data Backup and Recovery - Regular Testing

HIPAA Security Rule · 2 controls

164.308(a)(7)(ii)(A) Data Backup Plan (Required)
164.310(d)(2)(iv) Data Backup and Storage (Addressable)

ISO 27002:2022 · 2 controls

5.33 Protection of records
8.13 Information backup

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
NIST-CSF-PR.DS-11 Backups of data are created, protected, maintained, and tested

NIST SP 800-161 Rev 1 · 2 controls

161R1-CP-6 Alternative Storage Site
161R1-SI-12 Information Management and Retention

NIST SP 800-53 Rev 5 LOW · 2 controls

CP-10 System Recovery and Reconstitution
CP-9 System Backup

NIST SP 800-66 Rev 2 · 2 controls

164.308(a)(7)(ii)(A) Data Backup Plan (Required)
164.310(d)(2)(iv) Data Backup and Storage (Addressable)

SOC 2 · 2 controls

SOC2-A1.2 Environmental protections, data backups, and recovery infrastructure support availability
SOC2-A1.3 Recovery plan procedures support system recovery from failures

CMMC 2.0 · 1 control

MP.L2-3.8.9 Protect Backups

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-BCR-08 Backup

GDPR · 1 control

GDPR-Art.32 Security of processing

NIST SP 800-171 Rev 3 · 1 control

03.08.09 System Backup - Cryptographic Protection

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO 27701:2019 have you already done?

ISO 27701:2019 6.9.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.

If you hold SOC 253.7% covered · 50 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.147.2% covered · 57 gaps If you hold NIST Cybersecurity Framework 2.047.2% covered · 57 gaps If you hold ISO 27001:202243.5% covered · 61 gaps If you hold Australia Consumer Data Right - Banking (CDR)35.2% covered · 70 gaps If you hold C5 (Germany)34.3% covered · 71 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.

See the released pairs, $299 each Browse the graph free