Full backup
None of the held texts sets a fixed period on this consumer; every row below reads no period set by the text. Paste one job that feeds this consumer, for example prod_db_full_backup, weekly, and the register reads its period against the clocks below, names the gap in hours, and carries the question for its owner.
Matched on the job name or the consumer column by these words: full backup, backup, bkp, full dump, db dump, image backup, full backup. A backup, replication, feed or return job in this class is expected to name a fallback; a blank one is a finding.
The clock each rule sets
| Regime | Clock | Clause |
|---|---|---|
| ISO 27001 | no clock | ISO 27001 8.13 Information backup |
| SP 800-53 | no clock | SP 800-53 CP-9 System backupa defined frequency |
| DORA | no clock | DORA Art. 12 Backup policies and procedures, restoration and recovery |
| HIPAA | no clock | HIPAA 164.308(a)(7)(ii)(A) Data Backup Plan (Required) |
| ISO 22301 | no clock | ISO 22301 8.4.5 Recovery |
| NIS2 | no clock | NIS2 Art.21.2.c Business continuity, backup management, disaster recovery and crisis management |
Questions this page answers
How often does ISO/IEC 27001:2022 require full backup?
The held text of ISO 27001 8.13 (Information backup) sets no fixed period: no period set by the text. Maintain and regularly test backups of information, software and systems per the backup policy.
How often does NIST SP 800-53 Rev 5 require full backup?
The held text of SP 800-53 CP-9 (System backup) sets no fixed period: a defined frequency. Requires backups of user-level information, system-level information and system documentation including security and privacy documentation, each at an organization-defined frequency, and requires the confidentiality, integrity and availability of the backup information itself to be protected.
How often does DORA (Regulation (EU) 2022/2554) require full backup?
The held text of DORA Art. 12 (Backup policies and procedures, restoration and recovery) sets no fixed period: no period set by the text. Financial entities shall develop and document backup policies and procedures, and restoration and recovery procedures and methods, ensuring backups can be restored with minimal disruption, with backup systems physically and logically segregated from the source system.
How often does HIPAA Security Rule require full backup?
The held text of HIPAA 164.308(a)(7)(ii)(A) (Data Backup Plan (Required)) sets no fixed period: no period set by the text. Establish procedures to create and maintain retrievable exact copies of ePHI. NIST recommends offline or immutable backups, encryption, and regular restoration testing.
How often does ISO 22301:2019 require full backup?
The held text of ISO 22301 8.4.5 (Recovery) sets no fixed period: no period set by the text. Maintain documented processes to restore and return business activities from the temporary measures adopted during and after a disruption.
How often does NIS2 Directive require full backup?
The held text of NIS2 Art.21.2.c (Business continuity, backup management, disaster recovery and crisis management) sets no fixed period: no period set by the text. This category asks the entity to be able to keep providing its services, or to restore them, when systems fail or are attacked. Backup management means backups that are taken, protected against the same event that takes out production, and demonstrably restorable, which is why restore testing rather than backup success rate is the evidence that counts. Disaster recovery means recovery objectives that were derived from what the service can actually tolerate, and infrastructure and procedure capable of meeting them. Crisis management is the decision-making layer above both: who declares a crisis, who can commit the organisation, how the entity communicates while under pressure. Because NIS2 is concerned with continuity of service to recipients, recovery objectives set purely from internal convenience are the usual weak point.
What does the register ask the owner of a full backup job?
What is the fallback if this backup fails on the night, and which restore test job reads this set back?
The clauses in full
Maintain and regularly test backups of information, software and systems per the backup policy.
Guidance beside it, ISO 27002 8.13: Requires backup copies of information, software and systems to be maintained and regularly tested, in line with the agreed topic specific policy on backup. Supporting SME guidance treats regular creation of backups together with tested recovery as the substance of the control, not the copy on its own.
What an assessor asks to see: backup_policy; backup_schedule; backup_test_reports; retention_records. Where it usually falls short: infrequent restore testing
Requires backups of user-level information, system-level information and system documentation including security and privacy documentation, each at an organization-defined frequency, and requires the confidentiality, integrity and availability of the backup information itself to be protected.
What an assessor asks to see: Backup schedule and success reports covering user-level, system-level and documentation backups; Encryption and access control configuration protecting backup data; Restore test records proving backups are usable; Defined backup frequencies and evidence they are met. Where it usually falls short: Documentation and configuration backed up nowhere, only application data
Financial entities shall develop and document backup policies and procedures, and restoration and recovery procedures and methods, ensuring backups can be restored with minimal disruption, with backup systems physically and logically segregated from the source system.
What an assessor asks to see: Backup and restoration policies/procedures; Evidence of segregated backups and restoration tests. Where it usually falls short: No tested backups
Establish procedures to create and maintain retrievable exact copies of ePHI. NIST recommends offline or immutable backups, encryption, and regular restoration testing.
What an assessor asks to see: Backup policy and schedule; Backup completion logs; Restoration test results; Immutable or offline backup evidence. Where it usually falls short: Backups exist but never restored
Maintain documented processes to restore and return business activities from the temporary measures adopted during and after a disruption.
What an assessor asks to see: Documented restoration and return to normal processes; Criteria for deciding that temporary measures can be withdrawn; Evidence of use, from exercises or real events, including backlog clearance. Where it usually falls short: Recovery treated as implicit once the incident is closed, with no process behind it
This category asks the entity to be able to keep providing its services, or to restore them, when systems fail or are attacked. Backup management means backups that are taken, protected against the same event that takes out production, and demonstrably restorable, which is why restore testing rather than backup success rate is the evidence that counts. Disaster recovery means recovery objectives that were derived from what the service can actually tolerate, and infrastructure and procedure capable of meeting them. Crisis management is the decision-making layer above both: who declares a crisis, who can commit the organisation, how the entity communicates while under pressure. Because NIS2 is concerned with continuity of service to recipients, recovery objectives set purely from internal convenience are the usual weak point.
What an assessor asks to see: Business impact analysis deriving recovery time and recovery point objectives from service tolerance; Backup configuration showing isolation or immutability against destructive attack; Restore test results, dated, covering the systems that carry the essential service; The crisis management plan naming decision authority, activation criteria and communications routes. Where it usually falls short: Backups verified as completed but never restored end to end
Requirement text quoted from the standards themselves, published at compliance.theartofservice.com, the same publisher as this register, read against the held text of each standard: our statement of each clause, not the instrument verbatim. Run this job through the register