Restoration of data, applications and settings from backups to a common point in time…

frameworkASD Essential Eight sectionRegular backups levelsML1, ML2, ML3 csf 2.0PR.DS-11 PR.IR-03 RC.RP-02 RC.RP-03 RC.RP-05 topicsBackup & Recovery, Disaster Recovery frameworks0 11 2

Official textRestoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0

gap from Essential Eight → gap to Essential Eight →

Wrong or missing mapping? Report it

Equivalents of ISM-1515 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.DS-11 PR.IR-03 RC.RP-02 RC.RP-03 RC.RP-05	Backups of data are created, protected, maintained, and tested; Mechanisms are implemented to achieve resilience requirements in normal and adverse situations…	Editorial	Same topic: Backup & Recovery, Disaster Recovery (editorial pick)
ISO 27001	A.5.30 A.8.13 A.8.14	ICT readiness for business continuity; Information backup…	Editorial	Same topic: Disaster Recovery, Backup & Recovery (editorial pick) 6 loosely related (not mappings) A.5.26 Response to information security incidents Loosely related Only shares CSF RC.RP-02, RC.RP-05: related, not a mapping A.5.29 Information security during disruption Loosely related Only shares CSF PR.IR-03: related, not a mapping A.8.17 Clock synchronization Loosely related Only shares CSF PR.IR-03: related, not a mapping A.8.27 Secure system architecture and engineering principles Loosely related Only shares CSF PR.IR-03: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF PR.IR-03: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF PR.IR-03: related, not a mapping
CIS v8.1	CIS 11.1 CIS 11.2 CIS 11.3 CIS 11.4 CIS 11.5	Establish and Maintain a Data Recovery Process; Perform Automated Backups…	Editorial	Same topic: Disaster Recovery, Backup & Recovery (editorial pick)
SOC 2	A1.2 A1.3	Environmental protections, backups and recovery infrastructure; Testing recovery plan procedures	Editorial	Same topic: Backup & Recovery, Disaster Recovery (editorial pick) 4 loosely related (not mappings) CC7.5 Recovering from identified security incidents Loosely related Only shares CSF RC.RP-02, RC.RP-05: related, not a mapping A1.1 Capacity management to meet availability commitments Loosely related Only shares CSF PR.IR-03: related, not a mapping CC2.3 Communication with external parties Loosely related Only shares CSF RC.RP-05: related, not a mapping CC9.1 Mitigating risks from business disruptions Loosely related Only shares CSF PR.IR-03: related, not a mapping
PCI DSS	9.4.1.1 12.10.1	Offline backup media stored securely; Incident response plan ready to activate	Editorial	Same topic: Backup & Recovery, Disaster Recovery (editorial pick) 11 loosely related (not mappings) 9.4.1.2 Security of offline backup location reviewed annually Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping 12.10.2 Incident response plan reviewed and tested annually Loosely related Only shares CSF PR.IR-03, RC.RP-02: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Loosely related Only shares CSF PR.IR-03, RC.RP-02: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF RC.RP-02: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF RC.RP-02: related, not a mapping 5.3.2 Periodic scans or continuous behavioural analysis Loosely related Only shares CSF RC.RP-03: related, not a mapping 6.2.3 Custom code reviewed before release Loosely related Only shares CSF RC.RP-05: related, not a mapping 9.3.1.1 Sensitive-area access authorised and revoked promptly Loosely related Only shares CSF PR.DS-11: related, not a mapping …and 3 more in the downloads
CMMC	MP.L2-3.8.9	Protect Backups	Editorial	Same topic: Backup & Recovery (editorial pick) 2 loosely related (not mappings) IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF RC.RP-02: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.IR-03: related, not a mapping
800-53	CP-6 CP-7 CP-9 CP-10	Alternate Storage Site; Alternate Processing Site…	Editorial	Same topic: Backup & Recovery, Disaster Recovery (editorial pick) 11 loosely related (not mappings) CP-2 Contingency Plan Loosely related Only shares CSF RC.RP-03: related, not a mapping CP-4 Contingency Plan Testing Loosely related Only shares CSF RC.RP-03: related, not a mapping IR-4 Incident Handling Loosely related Only shares CSF RC.RP-02: related, not a mapping IR-8 Incident Response Plan Loosely related Only shares CSF RC.RP-02: related, not a mapping SA-8 Security and Privacy Engineering Principles Loosely related Only shares CSF PR.IR-03: related, not a mapping SA-24 Design For Cyber Resiliency Loosely related Only shares CSF PR.IR-03: related, not a mapping SC-6 Resource Availability Loosely related Only shares CSF PR.IR-03: related, not a mapping SC-24 Fail in Known State Loosely related Only shares CSF PR.IR-03: related, not a mapping …and 3 more in the downloads
HIPAA	§164.308(a)(7)(ii)(A)§164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(D)§164.310(d)(2)(iv)	Data Backup Plan; Disaster Recovery Plan…	Editorial	Same topic: Backup & Recovery, Disaster Recovery (editorial pick) 8 loosely related (not mappings) §164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Loosely related Only shares CSF RC.RP-02, RC.RP-03, RC.RP-05: related, not a mapping §164.310(a)(2)(i) Contingency Operations Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping §164.312(c) Integrity Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF RC.RP-02: related, not a mapping §164.308(a)(6)(ii) Response and Reporting Loosely related Only shares CSF RC.RP-02: related, not a mapping §164.308(a)(7) Contingency Plan Loosely related Only shares CSF RC.RP-03: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Loosely related Only shares CSF RC.RP-03: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF RC.RP-03: related, not a mapping
GDPR	Art.32(1)(c)	Security of processing	Editorial	Same topic: Backup & Recovery, Disaster Recovery (editorial pick) 2 loosely related (not mappings) Art.32(1)(b) Security of processing Loosely related Only shares CSF PR.IR-03: related, not a mapping Art.34(1) Communication of a personal data breach to the data subject Loosely related Only shares CSF RC.RP-05: related, not a mapping
NIS2	4.1 4.2	Business continuity and disaster recovery plan; Backup management	Editorial	Same topic: Disaster Recovery, Backup & Recovery (editorial pick) 1 loosely related (not mappings) 4.3 Crisis management Loosely related Only shares CSF PR.IR-03: related, not a mapping
DORA	Art.11(6)Art.12(1)Art.12(2)Art.12(3)Art.12(4)	Response and recovery; Backup policies and procedures, restoration and recovery procedures and methods…	Editorial	Same topic: Disaster Recovery, Backup & Recovery (editorial pick) 6 loosely related (not mappings) Art.11(1) Response and recovery Loosely related Only shares CSF PR.IR-03: related, not a mapping Art.11(2)(e) Response and recovery Loosely related Only shares CSF RC.RP-05: related, not a mapping Art.11(3) Response and recovery Loosely related Only shares CSF RC.RP-02: related, not a mapping Art.11(4) Response and recovery Loosely related Only shares CSF PR.IR-03: related, not a mapping Art.11(7) Response and recovery Loosely related Only shares CSF RC.RP-05: related, not a mapping Art.12(6) Backup policies and procedures, restoration and recovery procedures and methods Loosely related Only shares CSF RC.RP-02: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.