3.8.9

5.6.2.1 Organizations shall determine on a case-by-case basis what business information and software (including but not limited to sensitive information) is essential to the functioning of the organization, and
how frequently this information changes.NOTE: As an example, critical workstations and servers may require daily incremental backups, whereas desktops may be recovered from one common image.

5.6.2.2 Organizations shall determine on a case-by-case basis what systems to back up and at what frequency since every system will have different back-up and recovery requirements.

5.6.2.3 Organizations shall backup systems that contain essential business information and ensure that recovery mechanisms effectively and efficiently restore these systems from backups.

5.6.2.4 Organizations shall store backups at a secure offsite location (either physically or via network separated cloud services) at regular intervals to provide diversity in the event of a disaster
(fire, flood, earthquake or localized cyber security incident).

5.6.2.5 Organizations should consider the use of encrypted backups with securely stored and recoverable key material. Decryption keys and/or unencrypted backups should be stored securely and should be
accessible only to authorized employees or officers.

5.6.3.1 Organizations shall use a sampling of backup data to test and verify recovery procedures at regular intervals to ensure the integrity of the end-to-end backup and restoration process.