Requirement
In addition to the subcontrols in ECC control 2-9-3, cybersecurity requirements for backup and recovery management must include at least the following:
Sub-Controls
2-8-1-1
Requirement: Scope and coverage of online and offline backups shall cover all critical systems.
2-8-1-2
Requirement: Performing backup within planned intervals, according to the organization's risk assessment. NCA recommends performing backup for critical systems on a daily basis.
2-8-1-3
Requirement: Securing access, storage and transfer of critical systems' backups and storage media, and protecting it from destruction, unauthorized access or modification.
References
- ECC – 2:2024 equivalent: 2-9-3
