Habit 16 of 18
Recover
Automatic daily backups
Important data is copied every day, automatically, to somewhere separate.
Backups are what make ransomware survivable.
Switch it on in the map Counts towards 5 articles, controls and categories
§1 How to do it
How a small firm does it
- Back up important data automatically every day.
- Keep at least one copy separate from your main systems, so that ransomware cannot reach it.
- Include cloud services. Many do not back up your data the way you might expect.
- Check that backups succeed, and that someone notices when they fail.
Evidence that shows it
- The backup schedule and where copies are kept
- Backup success reports
Ireland: NCSC Ireland guidance on backup applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 2 items
-
21(2)(c) Business continuity, backups and crisis management · subset
business continuity, such as backup management and disaster recovery, and crisis management
Backup management is named in this measure, which also covers disaster recovery and crisis management.
Read Art 21(2)(c) on EUR-Lex -
21(2)(g) Basic cyber hygiene and training · supports
basic cyber hygiene practices and cybersecurity training
The recitals list backing up data among basic cyber hygiene practices (recital 49).
Read Art 21(2)(g) on EUR-Lex
General Data Protection Regulation 1 item
-
32(1)(c) Restoring access to data after an incident · supports
the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident
Backups are what make it possible to restore access to personal data after an incident.
Read Art 32(1)(c) on EUR-Lex
ISO/IEC 27001:2022 1 item
-
A.8.13 Backups · subset
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The control asks for backups to be kept and tested. Daily automatic copies are the first part.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 1 item
-
PR.DS Data security · subset
PR.DS-11: Backups of data are created, protected, maintained, and tested
In CSF 2.0, backups are a data security outcome: they are created, protected, maintained and tested.
Read PR.DS-11 on NIST
§3 Questions it answers
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.