Skip to content

Data Recovery

What is Data Recovery?

The process of restoring data that has been lost, corrupted, accidentally deleted, or otherwise made inaccessible from backup copies.

Information Security

Frameworks that govern data recovery

ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on data recovery

Requirements naming data recovery across 6 standards, quoted from the control text.

New Zealand Information Security Manual (NZISM)3 controls

Cryptographic products should offer a means to recover data when the encryption key cannot be used because it has been lost, damaged or has failed.

new-zealand-information-security-manual-nzism::17.1.52.C.02 · 17.1.52.C.02 Data recovery capability in cryptographic products →
CIS Controls v82 controls

At least once a quarter, test recovery from backup for a sample of in-scope enterprise assets.

CIS-11.5 · Test Data Recovery →
CIS Controls v8.12 controls

Test recovery from backup at least quarterly using a sample of in-scope assets. Implementation Groups: IG2 and IG3 (not in the IG1 baseline; applies from IG2 upward). Asset type: Data. Security function: Recover.

cis-controls-v8-1::11.5 · Test Data Recovery →
Australian Information Security Manual1 control

Where practical, cryptographic equipment, applications and libraries provide a means of data recovery to allow for circumstances where the encryption key is unavailable due to loss, damage or failure.

ISM-0455 · Data recovery for encrypted data →
BIMCO Cyber Security1 control

Be able to restore systems and data from a secure image or copy to get a clean system, with governance keeping backup images current and working, adequate backup of essential information and software, retention periods and restore scenarios prioritising critic...

BIMCO-10.4 · Data recovery capability →
HKMA Cyber Resilience Assessment Framework (C-RAF)2 controls

Baseline control principles for governance and preparation of incident response and recovery (required of every AI (minimum for a low inherent risk)).

hkma-cyber-resilience-assessment-framework-c-raf::5.1.B · 5.1 Governance and preparation of incident response and recovery: baseline level →

Questions people ask about data recovery

What is Data Recovery?
The process of restoring data that has been lost, corrupted, accidentally deleted, or otherwise made inaccessible from backup copies.
Why is Data Recovery important for compliance?
Data Recovery is a key concept in Information Security. Understanding data recovery helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Data Recovery?
Data Recovery appears in the requirement text of New Zealand Information Security Manual (NZISM), CIS Controls v8, CIS Controls v8.1, Australian Information Security Manual, BIMCO Cyber Security. Across these standards we have identified 11 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Data Recovery?
Explore our compliance framework pages to see how data recovery applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Data Recovery applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.