Backup Requirements Compared Across 11 Frameworks

Backups are one of the five topics every framework requires. The differences are in how often, how they're protected from attackers, and whether anyone has to prove a restore works.

This post covers the 11 frameworks ControlMapping mapped when it was written. Since then, DORA, CPS 234, Cyber Essentials were added on 2026-10-27; their pages and the coverage matrix include them.

Backup and recovery is in the common core: every one of the eleven frameworks we map requires it, including GDPR, which asks for the ability to restore availability and access to personal data in a timely manner. The requirement that differs most isn't frequency but protection: since ransomware began targeting backups, frameworks increasingly care whether an attacker who owns your network can destroy your copies too.

Who requires what

Framework	Backup & Recovery	Link
NIST CSF 2.0	PR.DS-11 RC.RP-03	Topic definition
ISO 27001	A.8.13	Crosswalk
CIS v8.1	CIS 11.2 CIS 11.3 CIS 11.5 CIS 11.4	Crosswalk
SOC 2	A1.2	Editorial
PCI DSS	9.4.1.1	Crosswalk
CMMC	MP.L2-3.8.9	Crosswalk
800-53	CP-6 CP-9	Crosswalk
HIPAA	§164.308(a)(7)(ii)(A)§164.310(d)(2)(iv)	Crosswalk
GDPR	Art.32(1)(c)	Editorial
NIS2	4.2	Crosswalk
Essential Eight	ISM-1511 ISM-1810 ISM-1811 ISM-1814 ISM-1707 ISM-1515	Editorial

Full detail and the reason for every link: Backup & Recovery across frameworks →

Frequency

Few frameworks set one. The CIS Controls ask for automated backups weekly or more often, depending on sensitivity (11.2). HIPAA requires a data backup plan to create and maintain retrievable exact copies of ePHI (§164.308(a)(7)(ii)(A)). The Essential Eight requires backups in line with business continuity requirements. ISO 27001 (A.8.13), SP 800-53 (CP-9) and SOC 2 (A1.2) leave the frequency to your recovery objectives, which is the right answer: back up as often as you can afford to lose.

Photograph of a stack of plain grey external hard drives inside an open fireproof cabinet — Ransomware made backup protection as important as backup frequency.

Protection

This is where frameworks differ most:

CIS requires recovery data to be protected (11.3) and an isolated instance of it (11.4): offline, cloud-isolated or otherwise out of reach of an attacker on the network.
The Essential Eight builds protection into its maturity levels: unprivileged accounts can't access other accounts' backups, and at the higher levels even privileged accounts can't modify or delete them.
CMMC requires the confidentiality of CUI in backups to be protected (MP.L2-3.8.9); PCI DSS requires offline backup media to be stored securely (9.4.1.1).
ISO 27001 and SOC 2 expect backups protected appropriately, without naming immutability.

Restore testing

CIS asks for recovery testing quarterly or more often, on a sample (11.5). The Essential Eight requires restoration of data, applications and settings to be tested in disaster recovery exercises. ISO 27001 requires backups to be tested, without a frequency, and SOC 2 auditors look for restore tests under A1.3. A backup nobody has restored is a hope, not a control.

Key takeaways

Backup and recovery is one of the five topics every framework we map requires.
Frameworks differ less on frequency than on protection: CIS and the Essential Eight explicitly protect backups from attackers.
Restore testing is the most neglected part; CIS asks for quarterly tests on a sample.
One baseline (regular backups, an isolated copy, encryption, quarterly restore tests) satisfies them all.
Cloud providers protect their infrastructure, not your data from deletion, corruption or encryption.

A baseline that satisfies all of them

Back up data, applications and configuration, at a frequency set by recovery point objectives, and at least weekly.
Keep at least one copy isolated, offline or immutable, that domain administrators can't delete.
Encrypt backups containing sensitive or regulated data.
Test restores quarterly on a sample, and do a full recovery exercise at least annually.
Record results, including failures and fixes: that's the evidence every auditor asks for.

The Backup & Recovery topic page lists every requirement with its source; Disaster Recovery and Business Continuity cover the wider plans. For the other topics every framework shares, see the common core.

Questions

How often must backups be tested?

The CIS Controls ask for recovery testing quarterly or more often (11.5), and the Essential Eight requires restoration to be tested as part of disaster recovery exercises. Most other frameworks require testing without a fixed frequency.

Do frameworks require offline or immutable backups?

Few say so explicitly. The CIS Controls require an isolated instance of recovery data (11.4), and the Essential Eight's higher maturity levels stop accounts, including privileged ones, from modifying or deleting backups.

Do cloud services remove the need for backups?

No. Cloud providers protect their infrastructure, but most don't protect you from deleting, corrupting or encrypting your own data. Frameworks still expect you to back up and test restores of what you're responsible for.

Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.

Backup and recovery requirements compared across frameworks