NIST Privacy Framework, Protect-PPR.PO-P3

Lay down and maintain a business continuity and disaster recovery plan, carry out a business impact analysis, and maintain backup copies of data (points 4.1.1, 4.1.3 and 4.2.1).

Develop and document backup policies and procedures and restoration and recovery procedures and methods, set up backup systems and test them periodically, and restore backup data on ICT systems that are physically and logically segregated from the source system. Unless you are a microenterprise, maintain redundant ICT capacities adequate to your business needs. If you are a central securities depository, maintain a secondary processing site that meets Article 12(5) (Article 12).

Develop, test and maintain a risk-based contingency plan, including an offsite recovery center kept separate from your main site, and a regularly checked backup system.

The Department says you should consider testing the integrity, immutability and restorability of backups, including validation of recovery time objectives, and reviewing and testing threat-relevant operational resilience procedures, such as incident response and business continuity plans, to protect and restore critical functions, information systems and nonpublic information.

Test your incident response and business continuity and disaster recovery plans with all staff and management critical to the response, and your ability to restore critical data and information systems from backups, periodically and at least annually, and revise the plans as necessary.

Maintain backups necessary to restore material operations, and protect them adequately from unauthorized alterations or destruction.

Prevent unauthorized access to the installations and data used for processing, guard against the processing being used for money laundering or terrorist financing, and keep backup copies for security.

Take precautions appropriate to the nature of the data, including restricting access to authorized staff and keeping security copies.

Take all necessary precautions to secure personal data against unauthorized modification, alteration or consultation, including physical access controls, a log of who accessed the system and when, and secure backup copies.

Make backups at suitable intervals, test them regularly, and keep them on equipment and at a location different from the primary storage (Article 8).

Keep backup copies of the health data in your Provider Bank and log any recovery of data from backups, so that the nature and extent of any data loss can be assessed (Article 27, paragraph 1, point (d)).