Environmental protections, backups and recovery infrastructure

frameworkSOC 2 (Trust Services Criteria) sectionA1 Availability csf 2.0GV.OC-04 PR.DS-11 PR.IR-03 RC.RP-02 RC.RP-03 RC.RP-04 RC.RP-05 topicsBackup & Recovery, Business Continuity, Disaster Recovery frameworks0 11 2

Official text · not licensableSummary (ControlMapping's wording): Environmental protections, backups and recovery infrastructure. The criterion text is AICPA's copyright.

gap from SOC 2 → gap to SOC 2 →

Wrong or missing mapping? Report it

Equivalents of A1.2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OC-04 PR.DS-11 PR.IR-03 RC.RP-02 RC.RP-03 RC.RP-04 RC.RP-05	Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated; Backups of data are created, protected, maintained, and tested…	Editorial	Same topic: Business Continuity, Backup & Recovery, Disaster Recovery (editorial pick)
ISO 27001	A.5.29 A.5.30 A.8.13 A.8.14 A.7.5	Information security during disruption; ICT readiness for business continuity…	Editorial	Same topic: Business Continuity, Disaster Recovery, Backup & Recovery (editorial pick) ControlMapping editorial: Environmental protections, backups and recovery infrastructure: backup (A.8.13), redundancy (A.8.14) and protection against environmental threats (A.7.5). 8 loosely related (not mappings) A.5.26 Response to information security incidents Loosely related Only shares CSF RC.RP-02, RC.RP-05: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.OC-04, PR.IR-03: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-04: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-04: related, not a mapping A.8.17 Clock synchronization Loosely related Only shares CSF PR.IR-03: related, not a mapping A.8.27 Secure system architecture and engineering principles Loosely related Only shares CSF PR.IR-03: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF PR.IR-03: related, not a mapping Clause 8.1 Operational planning and control Loosely related Only shares CSF RC.RP-04: related, not a mapping
CIS v8.1	CIS 11.1 CIS 11.2 CIS 11.3 CIS 11.4 CIS 11.5	Establish and Maintain a Data Recovery Process; Perform Automated Backups…	Editorial	Same topic: Disaster Recovery, Backup & Recovery (editorial pick)
PCI DSS	9.4.1.1 12.10.1	Offline backup media stored securely; Incident response plan ready to activate	Editorial	Same topic: Backup & Recovery, Business Continuity, Disaster Recovery (editorial pick) 14 loosely related (not mappings) 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping 9.4.1.2 Security of offline backup location reviewed annually Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping 12.5.1 Inventory of in-scope system components Loosely related Only shares CSF GV.OC-04, RC.RP-04: related, not a mapping 12.10.2 Incident response plan reviewed and tested annually Loosely related Only shares CSF PR.IR-03, RC.RP-02: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Loosely related Only shares CSF PR.IR-03, RC.RP-02: related, not a mapping 5.3.2 Periodic scans or continuous behavioural analysis Loosely related Only shares CSF RC.RP-03: related, not a mapping 6.2.3 Custom code reviewed before release Loosely related Only shares CSF RC.RP-05: related, not a mapping …and 6 more in the downloads
CMMC	MP.L2-3.8.9	Protect Backups	Editorial	Same topic: Backup & Recovery (editorial pick) 2 loosely related (not mappings) IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF RC.RP-02: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.IR-03: related, not a mapping
800-53	CP-2(8)CP-6 CP-7 CP-9 CP-10	Identify Critical Assets; Alternate Storage Site…	Editorial	Same topic: Business Continuity, Backup & Recovery, Disaster Recovery (editorial pick) 16 loosely related (not mappings) IR-8 Incident Response Plan Loosely related Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping PM-8 Critical Infrastructure Plan Loosely related Only shares CSF GV.OC-04, RC.RP-04: related, not a mapping PM-11 Mission and Business Process Definition Loosely related Only shares CSF GV.OC-04, RC.RP-04: related, not a mapping CP-2 Contingency Plan Loosely related Only shares CSF RC.RP-03: related, not a mapping CP-4 Contingency Plan Testing Loosely related Only shares CSF RC.RP-03: related, not a mapping IR-4 Incident Handling Loosely related Only shares CSF RC.RP-02: related, not a mapping PM-9 Risk Management Strategy Loosely related Only shares CSF RC.RP-04: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.OC-04: related, not a mapping …and 8 more in the downloads
HIPAA	§164.308(a)(7)(ii)(A)§164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(C)§164.308(a)(7)(ii)(D)§164.310(d)(2)(iv)	Data Backup Plan; Disaster Recovery Plan…	Editorial	Same topic: Backup & Recovery, Disaster Recovery, Business Continuity (editorial pick) 9 loosely related (not mappings) §164.310(a)(2)(i) Contingency Operations Loosely related Only shares CSF GV.OC-04, PR.DS-11, RC.RP-03: related, not a mapping §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping §164.308(a)(6)(ii) Response and Reporting Loosely related Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping §164.308(a)(7) Contingency Plan Loosely related Only shares CSF GV.OC-04, RC.RP-03: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Loosely related Only shares CSF GV.OC-04, RC.RP-03: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF GV.OC-04, RC.RP-03: related, not a mapping §164.312(c) Integrity Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping §164.316(b)(2)(ii) Availability Loosely related Only shares CSF RC.RP-04: related, not a mapping …and 1 more in the downloads
GDPR	Art.32(1)(b)Art.32(1)(c)	Security of processing; Security of processing	Editorial	Same topic: Business Continuity, Backup & Recovery, Disaster Recovery (editorial pick) 1 loosely related (not mappings) Art.34(1) Communication of a personal data breach to the data subject Loosely related Only shares CSF RC.RP-05: related, not a mapping
NIS2	4.1 4.2 4.3	Business continuity and disaster recovery plan; Backup management…	Editorial	Same topic: Business Continuity, Disaster Recovery, Backup & Recovery (editorial pick)
Essential Eight	ISM-1511 ISM-1515 ISM-1707 ISM-1810 ISM-1811 ISM-1814	Backups of data, applications and settings are performed and retained in accordance…; Restoration of data, applications and settings from backups to a common point in time……	Editorial	Same topic: Backup & Recovery, Disaster Recovery (editorial pick) 5 loosely related (not mappings) ISM-1705 Privileged user accounts (excluding backup administrator accounts) cannot access… Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1706 Privileged user accounts (excluding backup administrator accounts) cannot access their… Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1708 Backup administrator accounts are prevented from modifying and deleting backups during… Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1812 Unprivileged user accounts cannot access backups belonging to other user accounts Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1813 Unprivileged user accounts cannot access their own backups Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
DORA	Art.11(1)Art.11(4)Art.11(6)Art.12(1)Art.12(2)Art.12(3)Art.12(4)	Response and recovery; Response and recovery…	Editorial	Same topic: Business Continuity, Disaster Recovery, Backup & Recovery (editorial pick) 6 loosely related (not mappings) Art.8(1) Identification Loosely related Only shares CSF GV.OC-04: related, not a mapping Art.11(2)(e) Response and recovery Loosely related Only shares CSF RC.RP-05: related, not a mapping Art.11(3) Response and recovery Loosely related Only shares CSF RC.RP-02: related, not a mapping Art.11(5) Response and recovery Loosely related Only shares CSF GV.OC-04: related, not a mapping Art.11(7) Response and recovery Loosely related Only shares CSF RC.RP-05: related, not a mapping Art.12(6) Backup policies and procedures, restoration and recovery procedures and methods Loosely related Only shares CSF RC.RP-02: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.