Frameworks / NIST Cybersecurity Framework 2.0 / NIST-CSF-PR.DS-11 NIST Cybersecurity Framework 2.0
PR - Protect
NIST Cybersecurity Framework 2.0 NIST-CSF-PR.DS-11: Backups of data are created, protected, maintained, and tested Backups of data are created, protected, maintained, and tested. Control from NIST Cybersecurity Framework 2.0 framework, domain: PR - Protect.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 87 controls across 31 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
CIS-11.1 Establish and Maintain a Data Recovery Process CIS-11.2 Perform Automated Backups CIS-11.3 Protect Recovery Data CIS-11.4 Establish and Maintain an Isolated Instance of Recovery Data CIS-11.5 Test Data Recovery CIS-15.7 Securely Decommission Service Providers CIS-3.4 Enforce Data Retention CIS-3.5 Securely Dispose of Data CP-10(2) System Recovery and Reconstitution | Transaction Recovery (CP-10(2)) CP-6 Alternate Storage Site CP-6(1) Alternate Storage Site | Separation from Primary Site (CP-6(1)) CP-9 System Backup CP-9(1) Testing for Reliability and Integrity CP-9(8) System Backup | Cryptographic Protection (CP-9(8)) SI-12 Information Management and Retention CP-10(2) System Recovery and Reconstitution | Transaction Recovery (CP-10(2)) CP-6 Alternate Storage Site CP-6(1) Alternate Storage Site | Separation from Primary Site (CP-6(1)) CP-9 System Backup CP-9(1) Testing for Reliability and Integrity CP-9(8) System Backup | Cryptographic Protection (CP-9(8)) SI-12 Information Management and Retention ISM-1511 Backups aligned to business criticality ISM-1515 Testing restoration to a common point ISM-1707 Privileged accounts prevented from altering backups ISM-1811 Secure and resilient retention of backups C5-OPS-06 Data Backup and Recovery - Concept C5-OPS-07 Data Backup and Recovery - Monitoring C5-OPS-08 Data Backup and Recovery - Regular Testing C5-OPS-09 Data Backup and Recovery - Storage 5.30 ICT readiness for business continuity 5.33 Protection of records 8.13 Information backup 8.33 Test information 10.3.3 10.3.3 Audit logs promptly backed up to central secure storage 12.3.1 12.3.1 Targeted risk analysis for flexible-frequency requirements 9.4.1.1 9.4.1.1 Secure storage location for offline backups 9.4.1.2 9.4.1.2 Annual review of offline backup location security SOC2-A1.2 A1.2 Environmental protection, backup and recovery infrastructure SOC2-A1.3 A1.3 Testing recovery plan procedures SOC2-CC6.8 CC6.8 Preventing and detecting unauthorised or malicious software SOC2-PI1.5 PI1.5 Controls over stored inputs, work in process and outputs E8-BACKUP-ML1 Regular Backups (ML1) E8-BACKUP-ML2 Regular Backups (ML2) E8-BACKUP-ML3 Regular Backups (ML3) CFTC-SS-10 Geographic Dispersal of Backup Infrastructure and Personnel CFTC-SS-11 Testing and Review of Business Continuity and Disaster Recovery Capabilities CFTC-SS-8 Business Continuity and Disaster Recovery Plan and Resources 5.30 ICT readiness for business continuity 7.10 Storage media 8.13 Information backup ANSSI-HYG-37 Define and Apply a Backup Policy for Critical Components DORA-Art.12 Backup policies and procedures, restoration and recovery EN303645-5.11 Make it easy for users to delete user data 8.3.5 Implementation of solutions Art.21.2.c Business continuity, backup management, disaster recovery and crisis management PR.IP-4 PR.IP-4: Backups of information are conducted, maintained, and tested periodically PR.IP-4 PR.IP-4: Backups of information are conducted, maintained, and tested 03.08.09 System Backup - Cryptographic Protection PR.DS-11 PR.DS-11 Backups created, protected, maintained and tested for recovery Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in PR - Protect NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions NIST-CSF-PR.AA-03 Users, services, and hardware are authenticated NIST-CSF-PR.AA-04 Identity assertions are protected, conveyed, and verified NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties NIST-CSF-PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk NIST-CSF-PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind NIST-CSF-PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done? NIST Cybersecurity Framework 2.0 NIST-CSF-PR.DS-11 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 87 it maps to, and the evidence behind each claim, over MCP and REST.