This requirement exists to retain backups for periods based on legal, regulatory, and business requirements and securely dispose of expired copies and to ensure BCDR capabilities remain aligned with business needs, recovery objectives, and organizational risk.
Establish and document the process for retain backups for periods based on legal, regulatory, and business requirements and securely dispose of expired copies. Define accountable owners, required inputs and outputs, approval or validation points, criteria and thresholds, review frequency, exception handling, monitoring, reporting, and evidence requirements. Integrate the activity with risk management, incident response, technology operations, asset management, third-party management, and relevant business processes.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| CIS-V8 | CIS Controls CIS Controls are a prioritized set of cybersecurit... Clause: Control 11 – Data Recovery: 11.3 – Protect Recovery Data |
CIS
Best Practice
|
vv8 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.4 – Deliver, Service and Support (DSS) > DSS04 – Managed Continuity > DSS04.07 – Manage backup arrangements. |
COBIT
Governance Framework
|
v2019 | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 12(2) – Backup systems and periodic testing of backup/restoration/recovery procedures Article 12(4) – Redundant ICT capacities |
EU
Regulation
|
vCurrent | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 32(1)(b) – Confidentiality, integrity, availability and access resilience; Article 32(1)(c) – Timely restoration of availability and access |
EU
Regulation
|
vCurrent | View → |
| HIPAA | Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.312(i) Standard: Data backup and recovery |
US
Law
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.13-3.2.1 – Data backup; §2.6-3.1 – Backup and Restoration |
India
Guideline
|
vLatest | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 8.3.4 – Resource requirements; 8.3.5 – Implementation of solutions; 8.4.5 – Recovery |
ISO
Standard
|
v2019 | View → |
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 7.5.3 – Control of documented information |
ISO
Standard
|
v2022 | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 8.13 – Information backup |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(c) – Business continuity, including backup management, disaster recovery and crisis management |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: RC.RP – Incident Recovery Plan Execution | RC.RP-03 – The integrity of backups and other restoration assets is verified before using them for restoration |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.6 – CONTINGENCY PLANNING; CP-9 – SYSTEM BACKUP, CP-10 – SYSTEM RECOVERY AND RECONSTITUTION |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Operational Review; Business Continuity Plan – Disaster Recovery (DR) |
India
Standard
|
vLatest | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 9.4.1.1 – Offline media backups with cardholder data; 9.4.1.2 – The security of the offline media backup |
PCI
Standard
|
v4 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 19) Incident Response & Management – 19.4 BCP/DR supporting cyber resilience, rapid recovery and secure resumption aligned to RTOs |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 6.1 RC.RP: Incident Recovery Plan Execution |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: A1.2 – Availability – The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data backup processes, and recovery infrastructure to meet its objectives. A1.3 – Availability – The entity tests recovery plan procedures supporting system recovery to meet its objectives. CC7.5 – System Operations – The entity identifies, develops, and implements activities to recover from identified security incidents. C1.1 – Confidentiality – The entity identifies and maintains confidential information to meet the entity’s objectives related to confidentiality. |
AICPA
Audit Framework
|
vLatest | View → |