11.5
IG2 IG3

Test Data Recovery

Control Group: 11. Data Recovery
Asset Type: Data
Security Function: Recover

Description

Test backup recovery quarterly, or more frequently, for a sampling of in-scope enterprise assets.

Implementation Checklist

1
Define recovery objectives (RTO/RPO)
2
Implement recovery capabilities and procedures
3
Test recovery procedures on a regular schedule
4
Document recovery procedures and contact information
5
Identify critical data and systems requiring backup
6
Configure automated backup schedules
7
Verify backup integrity and test restoration
8
Store backups securely with offsite/air-gapped copies

Threats & Vulnerabilities (CIS RAM)

Threat Scenarios

Failed Recovery During Active Incident

Availability

During a critical ransomware or data loss incident, the organization attempts data recovery for the first time and discovers that backups are corrupted, incomplete, or cannot be restored due to incompatible software versions, extending downtime from days to weeks.

Silent Backup Corruption Going Undetected

Availability

Backup data has been silently corrupting for months due to storage errors, software bugs, or incomplete backup jobs, but without periodic restoration testing the corruption is only discovered when recovery is desperately needed during an actual incident.

Recovery Process Knowledge Gap Discovered During Crisis

Availability

Staff members who understood the backup and recovery procedures have departed, and without regular testing no current team member knows how to perform recovery, causing critical delays during an actual data loss event.

Vulnerabilities (When Safeguard Absent)

No Periodic Backup Recovery Testing

The organization creates backups but never tests the recovery process, meaning there is no verification that backup data is intact, complete, and can actually be restored to a functional state when needed.

Recovery Testing Does Not Cover Critical Assets

Even where some recovery testing occurs, it covers only a subset of backed-up systems and does not include the most critical databases, applications, or data stores, leaving recovery capability unverified for the highest-value assets.

Evidence Requirements

Type Evidence Item Collection Frequency
Document Recovery plan documentation Reviewed annually
Record Recovery test results and lessons learned Tested quarterly
Technical Backup job status reports and success rates Reviewed weekly
Record Backup restoration test results Tested quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually