DORA · Chapter II: ICT risk management
Art.12(3)
Backup policies and procedures, restoration and recovery procedures and methods
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0PR.DS-11 RC.RP-03
topicsBackup & Recovery
frameworks0 11 2
Official textWhen restoring backup data using own systems, financial entities shall use ICT systems that are physically and logically segregated from the source ICT system. The ICT systems shall be securely protected from any unauthorised access or ICT corruption and allow for the timely restoration of services making use of data and system backups as necessary. For central counterparties, the recovery plans shall enable the recovery of all transactions at the time of disruption to allow the central counterparty to continue to operate with certainty and to complete settlement on the scheduled date. Data reporting service providers shall additionally maintain adequate resources and have back-up and restoration facilities in place in order to offer and maintain their services at all times.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.DS-11RC.RP-03 | Backups of data are created, protected, maintained, and tested; The integrity of backups and other restoration assets is verified before using them for restoration | Editorial | Same topic: Backup & Recovery (editorial pick) |
| ISO 27001 | A.8.13 | Information backup | Editorial | Same topic: Backup & Recovery (editorial pick) |
| CIS v8.1 | CIS 11.2CIS 11.3CIS 11.4CIS 11.5 | Perform Automated Backups; Protect Recovery Data… | Editorial | Same topic: Backup & Recovery (editorial pick) |
| SOC 2 | A1.2 | Environmental protections, backups and recovery infrastructure | Editorial | Same topic: Backup & Recovery (editorial pick) |
| PCI DSS | 9.4.1.1 | Offline backup media stored securely | Editorial | Same topic: Backup & Recovery (editorial pick)5 loosely related (not mappings)9.4.1.2 Security of offline backup location reviewed annually Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping 12.10.1 Incident response plan ready to activate Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping 5.3.2 Periodic scans or continuous behavioural analysis Only shares CSF RC.RP-03: related, not a mapping 9.3.1.1 Sensitive-area access authorised and revoked promptly Only shares CSF PR.DS-11: related, not a mapping 9.4.7 Electronic media destroyed or made unrecoverable Only shares CSF PR.DS-11: related, not a mapping |
| CMMC | MP.L2-3.8.9 | Protect Backups | Editorial | Same topic: Backup & Recovery (editorial pick) |
| 800-53 | CP-6CP-9 | Alternate Storage Site; System Backup | Editorial | Same topic: Backup & Recovery (editorial pick) |
| HIPAA | §164.308(a)(7)(ii)(A)§164.310(d)(2)(iv) | Data Backup Plan; Data Backup and Storage | Editorial | Same topic: Backup & Recovery (editorial pick)8 loosely related (not mappings)§164.308(a)(7)(ii)(B) Disaster Recovery Plan Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping §164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Only shares CSF RC.RP-03: related, not a mapping §164.308(a)(7)(ii)(D) Testing and Revision Procedure Only shares CSF RC.RP-03: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF RC.RP-03: related, not a mapping |
| GDPR | Art.32(1)(c) | Security of processing | Editorial | Same topic: Backup & Recovery (editorial pick) |
| NIS2 | 4.2 | Backup management | Editorial | Same topic: Backup & Recovery (editorial pick) |
| Essential Eight | ISM-1511ISM-1515ISM-1707ISM-1810ISM-1811ISM-1814 | Backups of data, applications and settings are performed and retained in accordance…; Restoration of data, applications and settings from backups to a common point in time…… | Editorial | Same topic: Backup & Recovery (editorial pick)5 loosely related (not mappings)ISM-1705 Privileged user accounts (excluding backup administrator accounts) cannot access… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1706 Privileged user accounts (excluding backup administrator accounts) cannot access their… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1708 Backup administrator accounts are prevented from modifying and deleting backups during… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1812 Unprivileged user accounts cannot access backups belonging to other user accounts Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1813 Unprivileged user accounts cannot access their own backups Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.