DORA · Chapter II: ICT risk management
Art.12(2)
Backup policies and procedures, restoration and recovery procedures and methods
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0PR.DS-11 RC.RP-03
topicsBackup & Recovery
frameworks0 11 2
Official textFinancial entities shall set up backup systems that can be activated in accordance with the backup policies and procedures, as well as restoration and recovery procedures and methods. The activation of backup systems shall not jeopardise the security of the network and information systems or the availability, authenticity, integrity or confidentiality of data. Testing of the backup procedures and restoration and recovery procedures and methods shall be undertaken periodically.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.DS-11RC.RP-03 | Backups of data are created, protected, maintained, and tested; The integrity of backups and other restoration assets is verified before using them for restoration | Editorial | Same topic: Backup & Recovery (editorial pick) |
| ISO 27001 | A.8.13 | Information backup | Editorial | Same topic: Backup & Recovery (editorial pick) |
| CIS v8.1 | CIS 11.2CIS 11.3CIS 11.4CIS 11.5 | Perform Automated Backups; Protect Recovery Data… | Editorial | Same topic: Backup & Recovery (editorial pick) |
| SOC 2 | A1.2 | Environmental protections, backups and recovery infrastructure | Editorial | Same topic: Backup & Recovery (editorial pick) |
| PCI DSS | 9.4.1.1 | Offline backup media stored securely | Editorial | Same topic: Backup & Recovery (editorial pick)5 loosely related (not mappings)9.4.1.2 Security of offline backup location reviewed annually Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping 12.10.1 Incident response plan ready to activate Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping 5.3.2 Periodic scans or continuous behavioural analysis Only shares CSF RC.RP-03: related, not a mapping 9.3.1.1 Sensitive-area access authorised and revoked promptly Only shares CSF PR.DS-11: related, not a mapping 9.4.7 Electronic media destroyed or made unrecoverable Only shares CSF PR.DS-11: related, not a mapping |
| CMMC | MP.L2-3.8.9 | Protect Backups | Editorial | Same topic: Backup & Recovery (editorial pick) |
| 800-53 | CP-6CP-9 | Alternate Storage Site; System Backup | Editorial | Same topic: Backup & Recovery (editorial pick) |
| HIPAA | §164.308(a)(7)(ii)(A)§164.310(d)(2)(iv) | Data Backup Plan; Data Backup and Storage | Editorial | Same topic: Backup & Recovery (editorial pick)8 loosely related (not mappings)§164.308(a)(7)(ii)(B) Disaster Recovery Plan Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping §164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Only shares CSF RC.RP-03: related, not a mapping §164.308(a)(7)(ii)(D) Testing and Revision Procedure Only shares CSF RC.RP-03: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF RC.RP-03: related, not a mapping |
| GDPR | Art.32(1)(c) | Security of processing | Editorial | Same topic: Backup & Recovery (editorial pick) |
| NIS2 | 4.2 | Backup management | Editorial | Same topic: Backup & Recovery (editorial pick) |
| Essential Eight | ISM-1511ISM-1515ISM-1707ISM-1810ISM-1811ISM-1814 | Backups of data, applications and settings are performed and retained in accordance…; Restoration of data, applications and settings from backups to a common point in time…… | Editorial | Same topic: Backup & Recovery (editorial pick)5 loosely related (not mappings)ISM-1705 Privileged user accounts (excluding backup administrator accounts) cannot access… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1706 Privileged user accounts (excluding backup administrator accounts) cannot access their… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1708 Backup administrator accounts are prevented from modifying and deleting backups during… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1812 Unprivileged user accounts cannot access backups belonging to other user accounts Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1813 Unprivileged user accounts cannot access their own backups Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.