Habit 17 of 18
Recover
A restore tested this year
You have restored files from a backup this year and timed how long it took.
A backup you have never restored is a hope, not a plan. A test tells you it works and how long it takes.
Switch it on in the map Counts towards 8 articles, controls and categories
§1 How to do it
How a small firm does it
- Once a year, restore a real set of files, or a whole system, from backup.
- Time how long it takes and note any problems.
- Fix what went wrong and update your plan.
Evidence that shows it
- A record of the last test: what was restored, when, and how long it took
Ireland: NCSC Ireland guidance on backup and recovery applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 2 items
-
21(2)(c) Business continuity, backups and crisis management · supports
business continuity, such as backup management and disaster recovery, and crisis management
A tested restore is part of disaster recovery, which this measure names.
Read Art 21(2)(c) on EUR-Lex -
21(2)(f) Checking whether measures work · supports
policies and procedures to assess the effectiveness of cybersecurity risk-management measures
Testing a restore is a direct way to check that a measure works.
Read Art 21(2)(f) on EUR-Lex
General Data Protection Regulation 2 items
-
32(1)(c) Restoring access to data after an incident · supports
the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident
Article 32(1)(c) asks for the ability to restore access to personal data in a timely manner after an incident. A restore you have tested and timed is direct evidence of that ability.
Read Art 32(1)(c) on EUR-Lex -
32(1)(d) Regularly testing security measures · supports
a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
A restore test is one example of regularly testing a security measure.
Read Art 32(1)(d) on EUR-Lex
ISO/IEC 27001:2022 1 item
-
A.8.13 Backups · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The control expects backups to be tested.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 3 items
-
ID.IM Improvement · supports
ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
Timing a restore tells you what to improve.
Read ID.IM-02 on NIST -
PR.DS Data security · supports
PR.DS-11: Backups of data are created, protected, maintained, and tested
This outcome names testing backups. A restore is the test that matters.
Read PR.DS-11 on NIST -
RC.RP Carrying out the recovery plan · supports
RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration
RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed
A restore you have tested is a rehearsal of recovery: checking a backup is sound and bringing data back.
Read RC.RP-03, RC.RP-05 on NIST
§3 Questions it answers
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.