RES-03Resilience and Response
Backups that restore
Backups exist, are protected from the same failure as production, and restoration is tested.
Why it exists
An untested backup is a hope with a storage bill.
What usually proves it
Backup configuration, restore test records, retention.
Smaller organizations
One restore test a year, written down.
Mapped to
- Fully addressedSOC 2 Trust Services Criteria · A1.2
- Fully addressedISO/IEC 27001 Annex A · A.8.13
- Fully addressedNIST Cybersecurity Framework · PR.DS-11
- Partially addressedPCI DSS · 12.10.1 — Referenced through recovery in incident response.
- Fully addressedHIPAA Security Rule · 164.308(a)(7)(ii)(A)
- Fully addressedGDPR · Art. 32(1)(c)
- Deliberately absentEU AI Act — Not addressed.
- Partially addressedNIST AI Risk Management Framework · MANAGE 4.3 — Resilience to failure.