CIS Control 11: Data Recovery

Data loss can be a consequence of a variety of factors from malicious ransomware to hardware failures and even natural disasters. Regardless of the reason for data loss, we need to be able to restore our data. A data recovery plan begins with prioritizing our data, protecting it while it is being stored, and having a plan to recover data.   

Key Takeaways for Control 11

1. Prioritize your data and come up with a data recovery plan.
2. Protect your backed-up data. (See Control 3: Data Protection.)
3. Practice and Test restoring your data.
4. Restore your data after any compromise.

Availability of data is part of the triad of cybersecurity—Confidentiality, Integrity, and Availability. We should be able to recover data in an event of data loss but should also be able to recover if we have lost data integrity which may be the case after a security breach with unknown impacts on the system.

Safeguards for Control 11

11.1) Establish and Maintain a Data Recovery Process

Description: Establish and maintain a data recovery process. In the process, address the scope of data recovery activities, recovery prioritization, and the security of backup data. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard

Notes: The security function associated with this safeguard is Govern. Document your plan that includes what is being backed up, how it is protected, and how it will be recovered

11.2) Perform Automated Backups

Description: Perform automated backups of in-scope enterprise assets. Run backups weekly or more frequently, based on the sensitivity of the data.

Note: The security function associated with this safeguard is Recover. Classifying your data can help you determine how often it needs to be backed up.

11.3) Protect Recovery Data

Description: Protect recovery data with controls that are equivalent to the original data. Reference encryption or data separation based on requirements.

Notes: The security function associated with this safeguard is Protect. See Control 3 Data Protection and treat your backups like you would the original data.

11.4) Establish and Maintain an Isolated Instance of Recovery Data

Description: Establish and maintain an isolated instance of recovery data. Example implementations include version-controlling backup destinations through offline, cloud, and/or off-site systems or services.

Notes: The security function associated with this safeguard is Recover. Offline backups are very important for situations like ransomware and other malicious software, and offsite backups are important for disaster recovery. “Offline” backups mean the backup is not accessible via a network connection.

11.5) Test Data Recovery

Description: Test backup recovery quarterly, or more frequently, for a sampling of in-scope enterprise assets.

Notes: The security function associated with this safeguard is Recover. This often-overlooked part of a Data Recovery plan cannot be overstated. Having quality software and hardware for Data Recovery is all for naught if you do not have the skills and experience to use them. Backups for mission-critical infrastructure should be tested on a regular basis. This isn’t just to verify the integrity of the backups. It also ensures that staff has the know-how and experience to restore in a timely matter, as well.

See how simple and effective security controls can create a framework that helps you protect your organization and data from known cyber-attack vectors by downloading this guide here.

Read more about the 18 CIS Controls here:

CIS Control 1: Inventory and Control of Enterprise Assets

CIS Control 2: Inventory and Control of Software Assets

CIS Control 3: Data Protection

CIS Control 4: Secure Configuration of Enterprise Assets and Software

CIS Control 5: Account Management

CIS Control 6: Access Control Management

CIS Control 7: Continuous Vulnerability Management

CIS Control 8: Audit Log Management

CIS Control 9: Email and Web Browser Protections

CIS Control 10: Malware Defenses

CIS Control 11: Data Recovery

CIS Control 12: Network Infrastructure Management

CIS Control 13: Network Monitoring and Defense

CIS Control 14: Security Awareness and Skill Training

CIS Control 15: Service Provider Management

CIS Control 16: Application Software Security

CIS Control 17: Incident Response Management

CIS Control 18: Penetration Testing