Crossfoot
Crossfoot / Controls / Backup and redundancy
Draft v0.1.06 of 6 frameworks

Backup and redundancy

Data and systems are backed up, protected and restore-tested; critical systems have redundancy.

Where it appears

SOC 2
A1.2Data backup processes and recovery infrastructure
PCI DSS 4.0
12.10.1Incident response plan includes data backup processes
9.4.1.1Offline media backups with cardholder data are stored in a secure location
NIST CSF 2.0
PR.DS-11Backups of data are created, protected, maintained and tested
ISO 27001:2022
A.8.13Information backup
A.8.14Redundancy of information processing facilities
HIPAA Security Rule
164.308(a)(7)(ii)(A)Data backup plan
164.308(a)(7)(ii)(B)Disaster recovery plan
NIST 800-53 r5
CP-9System backup

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • Backup policy / schedule and retention settings
  • Backup job success reports across the audit period
  • Restore test results
  • Evidence backups are encrypted and access-controlled

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0