Requirement
In addition to subcontrols in the ECC control 2-9-3, cybersecurity requirements for backup and recovery management in OT/ICS must include, at a minimum, the following:
Sub-Controls
2-8-1-1
Requirement: Backups for all OT/ICS assets must be covered and stored in centralized and offline locations.
2-8-1-2
Requirement: OT/ICS assets' critical configuration files and engineering files must be included in the backup's scope.
2-8-1-3
Requirement: Backups must be performed periodically as per the defined OT/ICS assets classification and their associated risks.
2-8-1-4
Requirement: Access, storage, and transfer of backups and their mediums must be secured to ensure their protection against damage, change, or unauthorized access.
References
- ECC – 2:2024 equivalent: 2-9-3
