Safeguard 11.1 Data recovery process
The documented data recovery process that sets scope, recovery priorities and the security of backup data; the governing document for Control 11, separate from the technical backup safeguards 11.2 to 11.5.
Control 11 Data recovery
CIS Control 11 covers data recovery practices that can return in-scope enterprise assets to a trusted, pre-incident state: the recovery process, automated backups, protecting and isolating recovery data, and recovery testing.
Safeguard 11.2 Automated backups
Running automated backups of in-scope enterprise assets on a schedule set by data sensitivity, with CIS setting weekly as the minimum frequency; the core backup safeguard of Control 11.
Safeguard 11.3 Protect recovery data
Giving backup and recovery data the same protection as the original data, for example through encryption or separation; distinct from 11.4, which is about keeping an isolated copy.
Safeguard 11.4 Isolated copy of recovery data
Keeping an isolated instance of recovery data, such as offline, cloud or off-site versioned backup destinations, so backups survive ransomware or compromise of the primary environment.
Safeguard 11.5 Test data recovery
Testing backup recovery on a sample of in-scope enterprise assets at least quarterly; the only IG2 safeguard in Control 11 and the one that proves backups can actually be restored.
