Recovery Testing
What is Recovery Testing?
The verification that backup data and disaster recovery procedures can successfully restore systems and data within defined timeframes.
Terms that appear alongside recovery testing
Each of these is named in at least one of the same controls as recovery testing. The number is how many controls name both.
- encryption 3 shared controls
- ransomware 3 shared controls
- lessons learned 3 shared controls
- incident response 3 shared controls
- disruption 2 shared controls
- crisis management 2 shared controls
- cybersecurity 2 shared controls
- failover 2 shared controls
Frameworks that govern recovery testing
What the standards actually require on recovery testing
Requirements naming recovery testing across 6 standards, quoted from the control text.
A disaster recovery test plan is set and carried out to judge effectiveness, and recovery strategies are reviewed and updated regularly for test results, environment changes and legal changes.
south-korea-isms-p::2.12.2 · Disaster recovery testing and improvement →Document and communicate backup and recovery policies fixing backup scope, frequency and retention against contractual and internal RTO and RPO targets, requiring state of the art encryption of backups, restricting restores to authorised persons and mandating...
C5-OPS-06 · Data Backup and Recovery - Concept →Backup makes copies of data, records, configuration and software so that none of them is lost or left unusable and restore returns them when required, supporting disaster recovery; it is distinct from archiving and is not used as an archive.
gamp-5-good-automated-manufacturing-practice::O9 · Appendix O9 Backup and Restore →Baseline control principles for analysis, mitigation and restoration (required of every AI (minimum for a low inherent risk)). Incidents are classified by an established severity framework and triage;
hkma-cyber-resilience-assessment-framework-c-raf::5.2.B · 5.2 Analysis, mitigation and restoration: baseline level →The FI must set a recovery time objective of no more than 4 hours for each critical system (the time from disruption within which the system must be restored) and must validate and document at least once every 12 months how it performs system recovery testing...
monetary-authority-of-singapore-technology-risk-management-guidelines::TRMN.6 · Notice on TRM paragraph 6: RTO of at most 4 hours, validated every 12 months →Recovery work after an identified security incident is identified, developed and carried out. Points of focus: the affected environment is returned to working order by rebuilding systems, updating software, patching and reconfiguring;
SOC2-CC7.5 · CC7.5 Recovering from security incidents →Questions people ask about recovery testing
What is Recovery Testing?
Why is Recovery Testing important for compliance?
Which compliance frameworks address Recovery Testing?
Where can I learn more about Recovery Testing?
See how Recovery Testing applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.