CYB-18 · Cyber security

Backup and recovery — immutable, offsite backups tested; recovery time objective (RTO) defined

Ransomware renders unprotected backups useless. Backups must be: immutable or air-gapped (the 3-2-1-1 rule: 3 copies, 2 media types, 1 offsite, 1 immutable), encrypted at rest, and tested via restoration exercises at minimum quarterly. The RTO and RPO must be defined and achievable.

Critical priority

Trigger

When this rule fires

Backup only stored on same system as production data; no offsite/cloud backup; backup restoration not tested in last 6 months; no defined RTO/RPO; backups stored in same cloud tenant as primary systems (same ransomware blast radius)

Applicability gate

Confirm the entity's role before treating this as a duty

This is a readiness rule mapped to JS2 themes. Its presence in the library does not establish that JS2 applies directly to the firm.

Insurance Broker: Most independent non-life Category I brokers are not directly in JS2's defined scope. A broker may be directly in scope if it separately meets a listed category, and may face contract or oversight requirements from an in-scope institution. Third-party provisions impose duties on the in-scope financial institution. They do not themselves make every supplier or intermediary directly subject to JS2.
Uma Binder Holder: UMA or binder-holder status is not itself listed in JS2's definition. Direct scope depends on another listed capacity; insurer contracts and oversight may create evidence requirements. JS2 paragraph 3.3 concerns juristic persons structured under an insurer or designated insurance group; it is not a blanket rule for every independent UMA or intermediary.
Insurer: An insurer as defined in the Insurance Act is directly in scope of JS2 from 1 June 2025. Apply proportionality and distinguish the insurer's own duty from requirements it places on third parties.

Citation

Mapped source

This control maps to the public instruments below. The mapping does not establish entity applicability.

Section

Joint Standard 2 of 2024 — paragraphs 7.4 (response and recovery) and 7.8 (learning and evolving) / Joint Standard 1

Legislation

Joint Standard 2 of 2024
Joint Standard 1 of 2023

Remediation

How to close the gap

Implement 3-2-1-1 backup strategy. Use a separate cloud backup account from production tenant. Enable immutability/WORM on backup storage. Conduct quarterly restoration tests and document results. Define RTO (<4 hours) and RPO (<24 hours) for critical systems.

Evidence required

Evidence to prepare if this control applies

Backup configuration documentation (3-2-1-1 evidence)
Quarterly restoration test records with outcomes
Immutability configuration screenshot
RTO and RPO definitions in BCP
Separate backup account/tenant verification

← Back to Operational Resilience