Backup Essential Systems
Plain English Translation
Organizations must implement regular, reliable backups for any system that houses essential business information. These backups must be supported by proven recovery mechanisms to ensure that, in the event of an incident such as a ransomware attack or hardware failure, the data can be efficiently and effectively restored.
Technical Implementation
Use the tabs below to select your organization size.
Required Actions (startup)
- Identify all systems containing critical business data and configure automated backups for them.
- Ensure backups include critical cloud infrastructure, databases, and file shares.
- Verify that backup jobs complete successfully without errors and enable basic failure alerts.
Required Actions (scaleup)
- Implement a formal 3-2-1 backup strategy (3 copies of data, 2 different media, 1 offsite/cloud).
- Document a Disaster Recovery Plan with defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
- Perform periodic live test restores to validate recovery mechanisms and data integrity.
Required Actions (enterprise)
- Utilize immutable and air-gapped backups to provide robust protection against advanced ransomware threats.
- Automate continuous data protection and snapshotting across all dynamic environments to minimize data loss.
- Conduct comprehensive tabletop exercises and full-scale disaster recovery tests annually.
Section 5.6.2.3 requires organizations to back up systems containing essential business information and ensure that recovery mechanisms can effectively and efficiently restore these systems from backups.
Essential business information includes financial records, customer databases, intellectual property, and critical operational software. Any system required for the organization to function daily should be identified and backed up. Tools like WatchDog Security's Asset Inventory can help teams catalog systems and tag which assets store essential business data for backup scope.
Backup frequency should align with the system's Recovery Point Objective (RPO) and how frequently the data changes. Highly dynamic systems may require hourly backups, while static files may only need daily schedules.
Best practices dictate retaining backups long enough to recover from undetected breaches, often extending beyond 30 to 90 days. Retention policies must align with legal, regulatory, and specific business continuity needs.
Organizations must perform regular live restore tests using a sampling of backup data to verify that the recovery mechanisms function correctly and meet the required Recovery Time Objectives (RTO). Tools like WatchDog Security's Compliance Center can help track restore-test evidence against CSC-05-018 and flag missing or overdue recovery validation.
Effective recovery mechanisms include automated cloud failovers, bare-metal restore capabilities, VM snapshot rollbacks, and tested restoration procedures documented in a Business Continuity Plan.
Yes, backups should ideally be encrypted both in transit and at rest. Decryption keys must be stored securely and access restricted only to authorized personnel to prevent unauthorized data exposure.
Organizations should protect backups from ransomware by utilizing immutable storage (which cannot be altered or deleted) and maintaining offline or air-gapped copies separated from the primary network.
Cloud backups generally meet the offsite compliance requirement. However, to ensure robust disaster recovery and ransomware protection, cloud backups should be coupled with immutable storage or offline copies.
Auditors typically require backup configuration screenshots, failure notification setups, a documented business continuity or disaster recovery plan, and logs or reports proving recent successful restore tests. Tools like WatchDog Security's Compliance Center can help centralize this evidence and link it to CSC-05-018, and WatchDog Security's Trust Center can help share selected artifacts with external stakeholders when needed.
Backup compliance often fails during audits because evidence is scattered across tools and teams, and restore testing results aren’t consistently retained. Tools like WatchDog Security's Compliance Center can map evidence (configs, logs, restore test records) to CSC-05-018 and highlight gaps when scheduled backups or restore drills are missing.
Auditors typically expect controlled documents for backup scope, retention, RTO/RPO targets, and restore procedures, with clear ownership and revision history. Tools like WatchDog Security's Policy Management can help maintain version control, approvals, and attestations for backup and recovery policies so teams can demonstrate governance over time.
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0.0 | 2026-02-24 | WatchDog Security GRC Team | Initial publication |
