Backup Compliance Requirements in One Table
HIPAA, PCI DSS, SOC 2, NIST CSF, ISO 27001, IRS WISP and cyber insurance all ask about backups. Here is what each one asks, and the evidence that answers it.
A 72-hour restore target is proposed for HIPAA
HHS proposed in January 2025 that regulated organizations be able to restore critical systems within 72 hours. It is not final.
Your insurance application answers about backups must match reality
Wrong answers about backups and restore testing can create problems at claim time. We check the evidence.
One backup program, many frameworks
Most frameworks ask the same things in different words: back up important data, protect the backups, be able to restore within a defined time, test it and keep the evidence. The audit maps your backup and recovery controls to each framework you follow, so one set of evidence answers all of them.
This page summarizes common requirements for information only. It is not legal advice; confirm obligations with your compliance advisor or counsel.
Sources include 45 CFR 164.308 (eCFR), the proposed HIPAA Security Rule update (90 FR 898) and NIST Cybersecurity Framework 2.0 (CSWP 29).
Backup and recovery requirements by framework
| Framework | Backup and recovery requirement (summary) | Evidence the audit prepares |
|---|---|---|
| HIPAA Security Rule | Contingency plan under 45 CFR 164.308(a)(7): data backup plan, disaster recovery plan and emergency mode operation plan are required; testing and criticality analysis are addressable | Backup coverage of ePHI systems, DR plan review, test records |
| HIPAA (proposed, not final) | Written procedures to restore critical systems and data within 72 hours, among other changes proposed January 6, 2025 | Measured restore times against 72 hours, clearly labelled as proposed |
| PCI DSS v4.0.1 | Incident response plan includes business recovery and data backup processes; backup media is secured and its storage location reviewed | Backup handling for cardholder data, IR plan linkage |
| SOC 2 (Availability) | Availability criteria cover data backup processes, recovery infrastructure and recovery plan testing | Backup reports and restore test evidence for the audit period |
| NIST CSF 2.0 | PR.DS-11: backups are created, protected, maintained and tested; RC.RP-03: backup integrity verified before restoration | Maturity rating for Protect and Recover outcomes |
| ISO/IEC 27001:2022 | Annex A controls for information backup, redundancy, and ICT readiness for business continuity | Evidence for the Statement of Applicability |
| CCPA cybersecurity audit regulations | Business continuity, disaster recovery and backup capability is among the components a cybersecurity audit assesses | Backup and recovery evidence ready for the audit |
| IRS WISP and FTC Safeguards Rule | Tax and financial firms need a written security program and incident response plan; backup and recovery is a common WISP element | WISP backup section, recovery test records |
| Cyber insurance | Applications commonly ask about offline or immutable backups, MFA on backup access and restore testing | Evidence that application answers are accurate |
Summaries as of November 2026. Requirements change; check the current text of each framework.
What we look for and why
Map once
One set of backup evidence, mapped to every framework, saves repeated work at each audit.
Proposed is not final
We show readiness for proposed rules separately so you can plan without overstating obligations.
Evidence over policy
A policy that says “backups are tested” needs test records behind it.
A finding from the sample report
- Area
- Compliance and insurance evidence
- Finding
- Insurance application says backups are immutable; they are not
- Severity
- High
- Evidence
- The cyber insurance renewal answered yes to “offline or immutable backups.” The only off-site copy is a cloud bucket without object lock, and the local repository is a domain-joined NAS.
- Fix
- Enable immutability on the off-site copy, document it, and ask your broker whether the application answer needs correcting.
Every finding in the real report has this shape. See the full sample report
A read-only audit in five steps
Scoping call
We confirm your systems, backup products, cloud services, compliance needs and who on your side should take part.
Documents and interviews
We request your backup reports, DR plan, restore test records and BIA, and interview your IT lead and the business owners of critical systems.
Read-only review
We review backup consoles and cloud vaults through a read-only role or a screen-share. Nothing is installed or changed.
Analysis
96 checks in 8 domains, each rated Pass, Partial, Fail or Not applicable, with the evidence behind it.
Report and roadmap
Executive summary, technical report, risk register, remediation roadmap and Excel workbook, walked through on a call.
Where to go next
Want a quick self-check first? Backup and disaster recovery self-assessment · Ransomware recovery cost estimator
Page 12 of 16: Backup compliance requirements
- 1. Backup & Disaster Recovery Audit (hub)
- 2. Backup strategy: 3-2-1 and 3-2-1-1-0
- 3. Immutable & air-gapped backups
- 4. RPO, RTO, uptime & availability
- 5. Backup security hardening
- 6. Cloud backup for business
- 7. Microsoft 365 backup
- 8. Server, VM & database backup
- 9. Restore testing & evidence
- 10. Disaster recovery plan & DRaaS
- 11. Backup vendor selection guide
- 12. Backup compliance requirements (this page)
- 13. Sample report
- 14. Backup & DR checklist
- 15. Pricing
- 16. How to audit backups
Guided by Ali Hassani, CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, and dozens of Microsoft and Cisco certifications, including MCSE, MCITP, MCSA Security, CCNP and CCNA. Every backup and disaster recovery audit is read-only, vendor-neutral and written so an owner and an administrator can both act on it.
Questions IT leaders ask
Is backup required by HIPAA?
Yes. The HIPAA Security Rule requires a contingency plan that includes a data backup plan, a disaster recovery plan and an emergency mode operation plan (45 CFR 164.308(a)(7)). A proposed update would add more specific restoration requirements; it is not final.
Is this legal advice?
No. The audit maps technical controls and evidence to frameworks. Confirm legal obligations with your counsel or compliance advisor.
Do you change anything in our backup system?
No. The audit is read-only. We review settings, job history and documents through a read-only role or a screen-share with your administrator. We never change, delete or run backup jobs.
Implementation partner
OC Security Audit stays independent and read-only, and does not resell any backup product. If you want hands-on help installing or reconfiguring the product you choose, adding immutable storage or running restore tests, IT Perfection can do that work and support ongoing operations.
Answer every auditor’s backup questions with one set of evidence
Schedule a consultation. We scope the backup and disaster recovery audit in 30 minutes and quote one fixed price: $3,500, any organization size.
Read-only audit. No changes to your systems. Irvine, Orange County and Southern California on-site; remote nationwide.