[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F11":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","11","Control 11","Data Recovery",283,"Center for Internet Security (CIS)","**What it asks for.** This control requires organisations to establish data recovery practices that can restore in scope assets to a trusted state after an incident. It covers backup scope, automation, protection of backup data and regular recovery testing.\n\n**In practice.** A good approach defines what must be backed up and how often, automates backups and keeps at least one copy isolated from the production environment, for example offline or immutable, to resist ransomware. Backup data is encrypted and access to it is restricted. Recovery is tested on a schedule, including full system restores, and results are recorded. Evidence includes the recovery process, backup job reports, isolation configuration and restore test records.\n\n**Common gaps.** The most common gap is untested recovery: backups exist but restores fail or take far longer than the business can tolerate. Backup systems that share credentials with production are often destroyed along with it.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fdata-recovery","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"connectwise-cloud-backup-suspended-after-microsoft-365-tenant-compromise","ConnectWise Cloud Backup Suspended After Microsoft 365 Tenant Compromise","2026-10-18T10:20:20.475+00:00",{"slug":23,"title":24,"published_at":25},"bae-systems-breach-disrupts-federal-court-infrastructure-via-supply-chain-attack","BAE Systems Breach Disrupts Federal Court Infrastructure via Supply Chain Attack","2026-10-16T08:20:29.888+00:00",{"slug":27,"title":28,"published_at":29},"drone-strikes-on-yandex-data-centers-highlight-physical-resilience-gaps","Drone Strikes on Yandex Data Centers Highlight Physical Resilience Gaps","2026-10-12T20:20:18.165+00:00",{"slug":31,"title":32,"published_at":33},"qilin-ransomware-core-member-arrested-after-international-extradition","Qilin Ransomware Core Member Arrested After International Extradition","2026-10-09T16:20:38.53+00:00",{"slug":35,"title":36,"published_at":37},"ransomware-encrypts-36-pb-of-cloud-data-across-495-japanese-government-and-corporate-clients","Ransomware Encrypts 3.6 PB of Cloud Data Across 495 Japanese Government and Corporate Clients","2026-10-08T22:21:40.501+00:00",{"slug":39,"title":40,"published_at":41},"ransomware-groups-now-target-backups-first-recovery-is-no-longer-guaranteed","Ransomware Groups Now Target Backups First — Recovery Is No Longer Guaranteed","2026-10-07T16:21:31.344+00:00",{"slug":43,"title":44,"published_at":45},"qilin-ransomware-operator-arrested-lessons-from-a-global-extortion-campaign","Qilin Ransomware Operator Arrested: Lessons from a Global Extortion Campaign","2026-10-07T14:20:38.216+00:00",{"slug":47,"title":48,"published_at":49},"advantest-ransomware-attack-exposes-pii-including-ssns-and-financial-data","Advantest Ransomware Attack Exposes PII Including SSNs and Financial Data","2026-10-07T12:21:12.164+00:00",{"slug":51,"title":52,"published_at":53},"teen-alleged-to-lead-killsec-ransomware-gang-behind-500-victims","Teen Alleged to Lead KillSec Ransomware Gang Behind 500 Victims","2026-10-01T22:20:19.419+00:00",{"slug":55,"title":56,"published_at":57},"self-healing-wordpress-backdoor-defeats-standard-cleanup-methods","Self-Healing WordPress Backdoor Defeats Standard Cleanup Methods","2026-10-01T16:20:54.623+00:00",{"slug":59,"title":60,"published_at":61},"warlock-ransomware-targets-large-iberian-organizations-via-apt-linked-threat-actor","Warlock Ransomware Targets Large Iberian Organizations via APT-Linked Threat Actor","2026-10-01T14:20:52.331+00:00",{"slug":63,"title":64,"published_at":65},"metamask-infrastructure-breach-triggers-proactive-validator-exits","MetaMask Infrastructure Breach Triggers Proactive Validator Exits","2026-10-01T08:20:35.274+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",133,{"slug":73,"name":74,"problem":75,"stories":76},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",82,{"slug":78,"name":79,"problem":80,"stories":81},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",57,{"slug":83,"name":84,"problem":85,"stories":86},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",53,{"slug":88,"name":89,"problem":90,"stories":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",39,{"slug":93,"name":94,"problem":95,"stories":96},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",30,[98,104,110,115,120,125,130,135],{"family":99,"item":100,"code":101,"title":102,"together":103},"gdpr","32","Article 32","Security of processing",96,{"family":105,"item":106,"code":107,"title":108,"together":109},"nist-800-53","ir-4","IR-4","Incident Handling",88,{"family":111,"item":112,"code":113,"title":113,"together":114},"itil","overview","ITIL",66,{"family":5,"item":116,"code":117,"title":118,"together":119},"7","Control 7","Continuous Vulnerability Management",65,{"family":105,"item":121,"code":122,"title":123,"together":124},"cp-9","CP-9","System Backup",58,{"family":5,"item":126,"code":127,"title":128,"together":129},"12","Control 12","Network Infrastructure Management",54,{"family":5,"item":131,"code":132,"title":133,"together":134},"13","Control 13","Network Monitoring and Defense",50,{"family":99,"item":136,"code":137,"title":138,"together":139},"33","Article 33","Notification of a personal data breach to the supervisory authority",47]