LexLint.ioBeta

Know the law your code answers to.

Law / Frameworks / NIST CSF 2.0 / Protect

NIST CSF 2.0, ProtectPR.DS-11

Backups of data are created, protected, maintained, and testedNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), PR.DS-11

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .

7
laws
4
jurisdictions
0
with court rulings behind them
0
not yet in force

Related controls in other frameworks the same duties, in at least two laws we track, reach both

  • Canada
  • European Union
  • Haiti
  • New York

Sector security regimes

6 laws, 4 jurisdictions
JurisdictionLawWhat it asks, as read here
Canada OSFI Guideline B-13, Technology and Cyber Risk Management

Establish and maintain an enterprise disaster recovery program, and validate it against severe but plausible scenarios that test your backup and recovery capabilities and critical third-party technologies and integration points.
European Union Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures

Lay down and maintain a business continuity and disaster recovery plan, carry out a business impact analysis, and maintain backup copies of data (points 4.1.1, 4.1.3 and 4.2.1).
European Union DORA, Articles 5-16 (ICT Risk Management Framework)

Develop and document backup policies and procedures and restoration and recovery procedures and methods, set up backup systems and test them periodically, and restore backup data on ICT systems that are physically and logically segregated from the source system. Unless you are a microenterprise, maintain redundant ICT capacities adequate to your business needs. If you are a central securities depository, maintain a secondary processing site that meets Article 12(5) (Article 12).
Haiti BRH Circulaire 126, Information Security Rules for Financial Institutions

Develop, test and maintain a risk-based contingency plan, including an offsite recovery center kept separate from your main site, and a regularly checked backup system.
New York DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment

The Department says you should consider testing the integrity, immutability and restorability of backups, including validation of recovery time objectives, and reviewing and testing threat-relevant operational resilience procedures, such as incident response and business continuity plans, to protect and restore critical functions, information systems and nonpublic information.
New York New York Department of Financial Services Cybersecurity Regulation, Incident Response and Business Continuity Management

Test your incident response and business continuity and disaster recovery plans with all staff and management critical to the response, and your ability to restore critical data and information systems from backups, periodically and at least annually, and revise the plans as necessary.

Maintain backups necessary to restore material operations, and protect them adequately from unauthorized alterations or destruction.

Product security requirements

1 law, 1 jurisdiction
JurisdictionLawWhat it asks, as read here
European Union Data Act, Essential Requirements for Smart Contracts That Execute Data Sharing Agreements

Provide, for the case in which a smart contract must be terminated or deactivated, a possibility to archive the transactional data, the smart contract logic and the code, to keep the record of operations performed on the data in the past (Article 36(1), point (c)).

Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.