[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-13":3},{"item":4,"lessons":16,"controls":26,"related":48},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-13","Annex A 8.13","ISO\u002FIEC 27001:2022 Annex A 8.13: Information backup",2,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects backup copies of information, software and systems to be maintained and regularly tested in accordance with an agreed topic-specific backup policy. Its purpose is to enable recovery from loss of data or systems.\n\n**In practice.** Good practice means backups defined by business requirements for recovery, protected from the same threats as production, including ransomware, through isolation or immutability, and restored regularly to prove they work. Responsibility for backup of SaaS data is clarified with suppliers. Auditors expect the backup policy, job status records, restore test results and protection of backup systems.\n\n**Common gaps.** Common gaps are backups that have never been restored, backups reachable with the same administrator credentials as production and SaaS data assumed to be backed up by the provider.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22],{"slug":19,"title":20,"published_at":21},"microsoft-june-2026-updates-ai-driven-security-identity-resilience","Microsoft June 2026 Updates: AI-Driven Security & Identity Resilience","2026-06-30T18:21:32.705+00:00",{"slug":23,"title":24,"published_at":25},"microsoft-365-native-backup-falls-short-of-business-data-protection-needs","Microsoft 365 Native Backup Falls Short of Business Data Protection Needs","2026-06-18T14:20:32.243+00:00",[27,32,36,40,44],{"slug":28,"name":29,"problem":30,"stories":31},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":33,"name":34,"problem":35,"stories":31},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":37,"name":38,"problem":39,"stories":31},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":41,"name":42,"problem":43,"stories":31},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":45,"name":46,"problem":47,"stories":31},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[49,53,58,63,68,72,76,80],{"family":50,"item":51,"code":52,"title":52,"together":9},"itil","overview","ITIL",{"family":54,"item":55,"code":56,"title":57,"together":9},"gdpr","32","Article 32","Security of processing",{"family":59,"item":60,"code":61,"title":62,"together":9},"cis","11","Control 11","Data Recovery",{"family":64,"item":65,"code":66,"title":67,"together":9},"nist-800-53","cp-9","CP-9","System Backup",{"family":64,"item":69,"code":70,"title":71,"together":31},"cm-8","CM-8","System Component Inventory",{"family":64,"item":73,"code":74,"title":75,"together":31},"cp-10","CP-10","System Recovery and Reconstitution",{"family":64,"item":77,"code":78,"title":79,"together":31},"ra-5","RA-5","Vulnerability Monitoring and Scanning",{"family":81,"item":51,"code":82,"title":83,"together":31},"nist-ai-rmf","AI RMF 1.0","AI Risk Management Framework (AI RMF 1.0)"]