Summer Regulatory Summit eBook

7. Adequate Backup Processes & Testing

o Does the Organization perform backup and recovery testing annually - including restoration testing and/or functional failover testing? o Does the Institution maintain 3 backups, on 2 different data types, and one backup offsite ? Are the offsite backups segregated from the network (air-gapped) and/or immutable ?

CONTROL

o CSBS Ransomware Self-Assessment Tool (RSAT) o FFIEC Business Continuity Management Handbook o NIST Best Practices – separate locations for backups, testing processes, multiple copies, etc.

GUIDANCE

© SBS CyberSecurity, LLC www.sbscyber.com

23