UK Defence Standard 05-138 - Cyber Security for Defence Suppliers
DEFSTAN 05-138 Section D: Minimising the Impact of Incidents

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers D.3: Backup and Recovery

The supplier must maintain regular off-line backups of data off-site to enable recovery from cyber incidents.

What else in your programme already covers this

This control maps to 128 controls across 79 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

API 1164 · 3 controls

ASD Strategies to Mitigate Cyber Security Incidents · 3 controls

  • ASD37-34 Regular backups (Essential)
  • ASD37-35 Business continuity and disaster recovery plans (Very Good)
  • ASD37-36 System recovery capabilities (Very Good)

IEC 62443 · 3 controls

ISO 27019 · 3 controls

ISO/IEC 27031:2011 · 3 controls

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
  • NIST-CSF-RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related documentation is completed
  • NIST-CSF-RS.MA-05 The criteria for initiating incident recovery are applied

NIST SP 1800-32 · 3 controls

SANS Incident Handler's Handbook and PICERL Methodology · 3 controls

SSAE 18 - Attestation Standards (SOC Reporting) · 3 controls

FedRAMP Rev 5 · 2 controls

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2) · 2 controls

ISO 22316 · 2 controls

ISO 22317 · 2 controls

ISO 22318 · 2 controls

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management · 2 controls

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 2 controls

NIST SP 800-53 Rev 5 · 2 controls

SOC 2 · 2 controls

  • SOC2-A1.2 Environmental protections, data backups, and recovery infrastructure support availability
  • SOC2-A1.3 Recovery plan procedures support system recovery from failures

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 2 controls

South Korea ISMS-P · 2 controls

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.4.8 Business Continuity and Recovery

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 1 control

  • DIQ-1 Data Integration and Interoperability

FFIEC IT Examination Handbook · 1 control

FIRST CSIRT Services Framework and Standards · 1 control

  • FIRST-CSIRTF-SA2-ISIM Service Area 2 - Information Security Incident Management (Intake, Analysis, Containment, Recovery, Coordination, Crisis)

GAMP 5 - Good Automated Manufacturing Practice · 1 control

GLBA · 1 control

HKMA SPM · 1 control

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems · 1 control

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

IEEE 1686 · 1 control

ISMAP (Japan) · 1 control

ISO 22320:2018 · 1 control

ISO 27017 · 1 control

ISO 27018 · 1 control

ISO 27043 · 1 control

ISO/IEC 27011:2024 · 1 control

ISO/SAE 21434 · 1 control

Japan FSA Cybersecurity Guidelines for Financial Institutions · 1 control

MITRE ATT&CK · 1 control

MITRE D3FEND · 1 control

MTCS (Singapore) · 1 control

Monetary Authority of Singapore Technology Risk Management Guidelines · 1 control

NABERS - National Australian Built Environment Rating System · 1 control

  • NABERS-3 NABERS Water Performance Rating

NAIC Insurance Data Security Model Law (MDL-668) · 1 control

  • NAIC-5 Third Party Service Provider Oversight - Section 4(F)(3) and Section 5

NERC CIP · 1 control

  • NERCCIP-6 Incident Reporting and Response Planning + Recovery Plans (CIP-008 + CIP-009)

NIS2 Directive Implementing Acts · 1 control

  • NIS2I-3 Incident Handling Policy, Reporting Significance Criteria, and Business Continuity

NIST Privacy Framework · 1 control

  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) · 1 control

  • NISTSP115-8 Operational Considerations - Tools, Reporting Templates, ISMS Integration, Annex Material

NIST SP 800-123 · 1 control

  • NISTSP123-5 Server Operations - Patching, Malware, Logging, Backup

NIST SP 800-137 · 1 control

  • NISTSP137-7 Incident Response Integration and Ongoing Authorization

NIST SP 800-144 · 1 control

  • NISTSP144-6 Availability, Resilience, BCP/DR, and SLA Management

NIST SP 800-145 · 1 control

  • NISTSP145-3 Rapid Elasticity Characteristic and Capacity Management

NIST SP 800-146 · 1 control

  • NISTSP146-7 Service Level, Performance, Reliability, Interoperability, and Portability

NIST SP 800-190 · 1 control

NIST SP 800-61 · 1 control

NIST SP 800-63-4 · 1 control

  • NISTSP63R4-4 Authenticator Lifecycle: Binding, Recovery, Replacement, Suspension, Revocation

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 1 control

  • NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity

NIST SP 800-88 · 1 control

  • NISTSP88-5 Media Inventory, Tracking, Chain of Custody, and Sanitization Records

NIST SP 800-92 · 1 control

  • NISTSP92-6 Log Retention: Policy, Tiered Storage, Backup, Secure Disposal, Legal Hold

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity · 1 control

Nevada Gaming Control Board Cybersecurity Requirements · 1 control

  • NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation

OSFI B-13 · 1 control

  • OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery

OWASP MASVS · 1 control

  • OWASPMASVS-7 MASVS-RESILIENCE: Resilience Against Reverse Engineering

OWASP SAMM · 1 control

  • OWASPSAMM-5 Operations: Incident Management, Environment Management, Operational Management

Oman National Cybersecurity Framework · 1 control

  • OMANCS-7 Business Continuity, Disaster Recovery, and Resilience

Open Banking Security · 1 control

  • OPENBANK-8 Incident Detection, Response, Customer Notification, Post-Incident Review, BCM

OpenSSF Scorecard · 1 control

  • OSSFSC-8 Project Maintenance, Sustainability, Integration with Supply Chain Security

PCI P2PE · 1 control

PCI PIN Security · 1 control

PCI SSF · 1 control

PSD2 SCA · 1 control

  • PSDTWO-2 SCA Exemptions and Risk-Based Authentication

PTES · 1 control

SIG (Shared Assessments) · 1 control

  • SHAREASSESS-4 Vulnerability Management, Patching, Application Security

SLSA · 1 control

  • SUPCHAIN-2 Source Integrity - Branch Protection, Code Review, Two-Person Rule

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

TISAX - Trusted Information Security Assessment Exchange · 1 control

TSA Pipeline Cybersecurity Directives · 1 control

  • TSAPIPE-2 OT/IT Network Segmentation and Access Control

UK Security and Emergency Measures Direction (SEMD) - Water Industry · 1 control

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements · 1 control

  • CYB-5 Cyber Incident Response Plan

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in DEFSTAN 05-138 Section D: Minimising the Impact of Incidents

Query this from an agent

The graph holds this control, the 128 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll UK Defence Standard 05-138 - Cyber Security for Defence Suppliers controls