SekitCrosswalk
ENES
Start now
Sekit CSF · Family

Backup & Recovery

21 controls in 7 topics, each seen through the policy, process and technical lenses.

Policy

RCF-0244Backup coverage4 mappingsAll critical systems and data are formally required to be included in the backup programmeRCF-0238Backup policy4 mappingsThe company has a formal policy defining how often data is backed up and how backups are protectedRCF-0253DR exercises5 mappingsDisaster recovery is formally exercised on a regular schedule to validate recovery capabilityRCF-0241Immutable/offsite backups4 mappingsBackups are formally required to be stored in a location that cannot be modified or deleted by attackersRCF-0247Restore testing5 mappingsThe company formally requires that backups are regularly tested to confirm data can be recoveredRCF-0250RTO/RPO definitions4 mappingsMaximum acceptable recovery time and data loss are formally defined for all critical systemsRCF-0256Runbooks for recovery5 mappingsDocumented step-by-step recovery procedures exist for all critical system failures

Process

RCF-0245Backup coverage4 mappingsBackup coverage is consistently reviewed to ensure no critical data is excludedRCF-0239Backup policy4 mappingsBackup procedures are consistently followed and backup completion is verified regularlyRCF-0254DR exercises5 mappingsDisaster recovery exercises are consistently conducted and findings drive improvements to recovery plansRCF-0242Immutable/offsite backups3 mappingsImmutable and offsite backup copies are consistently maintained and verifiedRCF-0248Restore testing5 mappingsRestore tests are consistently conducted and results are documented to confirm recovery capabilityRCF-0251RTO/RPO definitions4 mappingsRecovery time and point objectives are consistently communicated and factored into recovery planningRCF-0257Runbooks for recovery5 mappingsRecovery runbooks are consistently followed during incidents and kept current with system changes

Technical

RCF-0246Backup coverage3 mappingsTechnical tools monitor backup coverage and alert when critical systems fall outside the backup scopeRCF-0240Backup policy3 mappingsTechnical controls automate backup execution and alert when backups fail or are incompleteRCF-0255DR exercises6 mappingsTechnical tools support realistic disaster recovery simulation without impacting production systemsRCF-0243Immutable/offsite backups4 mappingsTechnical controls enforce write-once backup storage and replicate copies to a separate secure locationRCF-0249Restore testing4 mappingsTechnical controls automate restore testing and validate the integrity of recovered dataRCF-0252RTO/RPO definitions4 mappingsTechnical architecture is designed to meet defined recovery time and recovery point objectivesRCF-0258Runbooks for recovery5 mappingsTechnical tools provide guided recovery procedures and track execution steps during incidents

This family in ISO/IEC 27001:2022

Every framework item the family's controls map to, most-connected first — grouped by Sekit CSF family, never by the framework's own index.

A.8.13 Information backupA.5.30 ICT readiness for business continuityA.5.1 Policies for information securityA.5.37 Documented operating proceduresA.5.29 Information security during disruptionA.8.14 Redundancy of information processing facilitiesA.8.15 LoggingA.5.36 Compliance with policies, rules and standards for information securityA.8.24 Use of cryptographyA.5.27 Learning from information security incidents

This family in NIST CSF 2.0

PR.IR-04 Adequate capacity maintainedRC.RP-01 Recovery plan executedPR.DS-10 Data-in-use protectedRC.RP-02 Recovery actions performedRC.RP-03 Backup integrity verified
Ask Sekura: “What evidence proves Backup & Recovery?”
Also via MCP, free with account