Security of processing

frameworkGDPR sectionRequirements csf 2.0ID.IM-04 PR.DS-11 PR.IR-03 RC.RP-01 RC.RP-02 RC.RP-03 RC.RP-05 topicsBackup & Recovery, Recovery Planning, Disaster Recovery frameworks0 11 2

Official text · not licensableSee the official text of GDPR.

gap from GDPR → gap to GDPR →

Wrong or missing mapping? Report it

Equivalents of Art.32(1)(c) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.IM-04 PR.DS-11 PR.IR-03 RC.RP-01 RC.RP-02 RC.RP-03 RC.RP-05	Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved; Backups of data are created, protected, maintained, and tested…	Editorial	Same topic: Recovery Planning, Backup & Recovery, Disaster Recovery (editorial pick)
ISO 27001	A.5.29 A.5.30 A.8.13 A.8.14	Information security during disruption; ICT readiness for business continuity…	Editorial	Same topic: Recovery Planning, Disaster Recovery, Backup & Recovery (editorial pick) 5 loosely related (not mappings) A.5.26 Response to information security incidents Loosely related Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02, RC.RP-05: related, not a mapping A.8.17 Clock synchronization Loosely related Only shares CSF PR.IR-03: related, not a mapping A.8.27 Secure system architecture and engineering principles Loosely related Only shares CSF PR.IR-03: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF PR.IR-03: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF PR.IR-03: related, not a mapping
CIS v8.1	CIS 11.1 CIS 11.2 CIS 11.3 CIS 11.4 CIS 11.5	Establish and Maintain a Data Recovery Process; Perform Automated Backups…	Editorial	Same topic: Recovery Planning, Disaster Recovery, Backup & Recovery (editorial pick)
SOC 2	A1.2 A1.3 CC7.5	Environmental protections, backups and recovery infrastructure; Testing recovery plan procedures…	Editorial	Same topic: Backup & Recovery, Disaster Recovery, Recovery Planning (editorial pick) 3 loosely related (not mappings) A1.1 Capacity management to meet availability commitments Loosely related Only shares CSF PR.IR-03: related, not a mapping CC2.3 Communication with external parties Loosely related Only shares CSF RC.RP-05: related, not a mapping CC9.1 Mitigating risks from business disruptions Loosely related Only shares CSF PR.IR-03: related, not a mapping
PCI DSS	9.4.1.1 12.10.1	Offline backup media stored securely; Incident response plan ready to activate	Editorial	Same topic: Backup & Recovery, Recovery Planning, Disaster Recovery (editorial pick) 12 loosely related (not mappings) 12.10.2 Incident response plan reviewed and tested annually Loosely related Only shares CSF ID.IM-04, PR.IR-03, RC.RP-01, RC.RP-02: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Loosely related Only shares CSF ID.IM-04, PR.IR-03, RC.RP-02: related, not a mapping 9.4.1.2 Security of offline backup location reviewed annually Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping 12.10.3 Incident response staff available around the clock Loosely related Only shares CSF ID.IM-04, RC.RP-01: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF RC.RP-02: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF RC.RP-02: related, not a mapping 5.3.2 Periodic scans or continuous behavioural analysis Loosely related Only shares CSF RC.RP-03: related, not a mapping 6.2.3 Custom code reviewed before release Loosely related Only shares CSF RC.RP-05: related, not a mapping …and 4 more in the downloads
CMMC	MP.L2-3.8.9	Protect Backups	Editorial	Same topic: Backup & Recovery (editorial pick) 2 loosely related (not mappings) IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF RC.RP-01, RC.RP-02: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.IR-03: related, not a mapping
800-53	CP-2 CP-6 CP-7 CP-9 CP-10	Contingency Plan; Alternate Storage Site…	Editorial	Same topic: Recovery Planning, Backup & Recovery, Disaster Recovery (editorial pick) 10 loosely related (not mappings) IR-8 Incident Response Plan Loosely related Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping IR-4 Incident Handling Loosely related Only shares CSF RC.RP-01, RC.RP-02: related, not a mapping CP-4 Contingency Plan Testing Loosely related Only shares CSF RC.RP-03: related, not a mapping SA-8 Security and Privacy Engineering Principles Loosely related Only shares CSF PR.IR-03: related, not a mapping SA-24 Design For Cyber Resiliency Loosely related Only shares CSF PR.IR-03: related, not a mapping SC-6 Resource Availability Loosely related Only shares CSF PR.IR-03: related, not a mapping SC-24 Fail in Known State Loosely related Only shares CSF PR.IR-03: related, not a mapping SC-36 Distributed Processing and Storage Loosely related Only shares CSF PR.IR-03: related, not a mapping …and 2 more in the downloads
HIPAA	§164.308(a)(7)§164.308(a)(7)(ii)(A)§164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(D)§164.310(d)(2)(iv)	Contingency Plan; Data Backup Plan…	Editorial	Same topic: Recovery Planning, Backup & Recovery, Disaster Recovery (editorial pick) 7 loosely related (not mappings) §164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Loosely related Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02, RC.RP-03…: related, not a mapping §164.308(a)(6)(ii) Response and Reporting Loosely related Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping §164.310(a)(2)(i) Contingency Operations Loosely related Only shares CSF ID.IM-04, PR.DS-11, RC.RP-03: related, not a mapping §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF RC.RP-01, RC.RP-02: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Loosely related Only shares CSF ID.IM-04, RC.RP-03: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF ID.IM-04, RC.RP-03: related, not a mapping §164.312(c) Integrity Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
NIS2	4.1 4.2	Business continuity and disaster recovery plan; Backup management	Editorial	Same topic: Recovery Planning, Disaster Recovery, Backup & Recovery (editorial pick) 1 loosely related (not mappings) 4.3 Crisis management Loosely related Only shares CSF PR.IR-03: related, not a mapping
Essential Eight	ISM-1511 ISM-1515 ISM-1707 ISM-1810 ISM-1811 ISM-1814	Backups of data, applications and settings are performed and retained in accordance…; Restoration of data, applications and settings from backups to a common point in time……	Editorial	Same topic: Backup & Recovery, Disaster Recovery (editorial pick) 5 loosely related (not mappings) ISM-1705 Privileged user accounts (excluding backup administrator accounts) cannot access… Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1706 Privileged user accounts (excluding backup administrator accounts) cannot access their… Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1708 Backup administrator accounts are prevented from modifying and deleting backups during… Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1812 Unprivileged user accounts cannot access backups belonging to other user accounts Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1813 Unprivileged user accounts cannot access their own backups Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
DORA	Art.11(3)Art.11(6)Art.12(1)Art.12(2)Art.12(3)Art.12(4)Art.12(6)	Response and recovery; Response and recovery…	Editorial	Same topic: Recovery Planning, Disaster Recovery, Backup & Recovery (editorial pick) 4 loosely related (not mappings) Art.11(1) Response and recovery Loosely related Only shares CSF PR.IR-03: related, not a mapping Art.11(2)(e) Response and recovery Loosely related Only shares CSF RC.RP-05: related, not a mapping Art.11(4) Response and recovery Loosely related Only shares CSF PR.IR-03: related, not a mapping Art.11(7) Response and recovery Loosely related Only shares CSF RC.RP-05: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.