Skip to main content
← All controls
CP-9 / A.8.13 / CIS-11.3 NIST SP 800-53 Rev 5

Are important business files (cloud + local) backed up?

Demonstrate that important business files across cloud and local environments are identified, backed up according to defined schedules and retention policies, and that backups are tested for successful restoration.

Description

What this control does

This control ensures that critical business data stored in both cloud platforms (SaaS, IaaS, PaaS) and on-premises or local endpoints is systematically backed up to enable recovery in the event of ransomware, hardware failure, accidental deletion, or disaster. It requires identification of what constitutes 'important' data, defined backup frequency and retention policies, automated backup execution, and periodic restoration testing. Effective backup practices form the foundation of business continuity and cyber resilience, particularly against destructive malware and insider threats.

Control objective

What auditing this proves

Demonstrate that important business files across cloud and local environments are identified, backed up according to defined schedules and retention policies, and that backups are tested for successful restoration.

Associated risks

Risks this control addresses

  • Permanent loss of critical business data due to ransomware encryption without recoverable backups
  • Inability to restore operations after catastrophic hardware failure, natural disaster, or datacenter outage
  • Loss of intellectual property, financial records, or customer data following accidental deletion or malicious insider activity
  • Regulatory non-compliance due to inability to produce required records following data loss incidents
  • Extended downtime and revenue loss when backup systems fail or backups are found to be corrupted during emergency restoration attempts
  • Incomplete or inconsistent backups due to unidentified critical data repositories or shadow IT cloud services
  • Backup compromise through attacker lateral movement to backup infrastructure, preventing clean recovery from known-good state

Testing procedure

How an auditor verifies this control

  1. Obtain and review the organization's data classification and criticality inventory to identify which business files are classified as important or critical for backup.
  2. Retrieve the current backup policy documentation, including defined Recovery Point Objectives (RPO), Recovery Time Objectives (RTO), retention schedules, and scope of coverage for cloud and local environments.
  3. Enumerate all backup solutions in use (cloud-native tools, third-party agents, local backup appliances) and obtain configuration exports showing backup job definitions, schedules, and included/excluded paths.
  4. Select a representative sample of important business files from both cloud repositories (e.g., SharePoint, Google Drive, Salesforce) and local systems (file servers, databases, endpoint laptops) and verify each is covered by an active backup job.
  5. Review backup job execution logs for the past 90 days to identify failures, incomplete runs, or jobs consistently skipping files due to locks or permissions issues.
  6. Request evidence of backup restoration tests performed within the past 12 months, including test plans, actual restored data samples, validation results, and time-to-restore measurements.
  7. Verify that backup storage is logically or physically separated from production environments and protected by distinct access controls to prevent simultaneous compromise.
  8. Confirm that backup integrity mechanisms (checksums, encryption validation, immutability features) are enabled and review evidence of automated integrity verification for stored backups.
Evidence required Auditor collects data classification inventories, backup policy documents with defined RPO/RTO, configuration exports from all backup platforms showing job schedules and scope, execution logs demonstrating successful completion rates over 90 days, restoration test reports with timestamps and validation outcomes, access control matrices separating backup administrator privileges from production, and integrity verification reports or immutability configuration screenshots from backup storage systems.
Pass criteria All files classified as important are covered by automated backup jobs executing at frequencies meeting defined RPO requirements, backup completion rates exceed 95% over the review period, at least one successful restoration test has been performed and documented in the past 12 months, and backup repositories are protected by separate credentials with integrity verification enabled.