RES-03 · Resilience and Response
Backups that restore
Backups exist, are protected from the same failure as production, and restoration is tested.
5frameworks fully address it
2partially
1leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullA1.2
- ISO 27001FullA.8.13
- NIST CSFFullPR.DS-11
- PCI DSSPartial12.10.1 Referenced through recovery in incident response.
- HIPAAFull164.308(a)(7)(ii)(A)
- GDPRFullArt. 32(1)(c)
- EU AI ActAbsent Not addressed.
- NIST AI RMFPartialMANAGE 4.3 Resilience to failure.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Backup configuration, restore test records, retention.
?Why it exists
An untested backup is a hope with a storage bill.
For a smaller organizationOne restore test a year, written down.