[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F11":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","11","Control 11","Data Recovery",283,"Center for Internet Security (CIS)","**What it asks for.** This control requires organisations to establish data recovery practices that can restore in scope assets to a trusted state after an incident. It covers backup scope, automation, protection of backup data and regular recovery testing.\n\n**In practice.** A good approach defines what must be backed up and how often, automates backups and keeps at least one copy isolated from the production environment, for example offline or immutable, to resist ransomware. Backup data is encrypted and access to it is restricted. Recovery is tested on a schedule, including full system restores, and results are recorded. Evidence includes the recovery process, backup job reports, isolation configuration and restore test records.\n\n**Common gaps.** The most common gap is untested recovery: backups exist but restores fail or take far longer than the business can tolerate. Backup systems that share credentials with production are often destroyed along with it.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fdata-recovery","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},302,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"ransomware-encrypts-cloud-providers-infrastructure-disrupting-customers-for-days","Ransomware Encrypts Cloud Provider's Infrastructure, Disrupting Customers for Days","2026-11-13T15:20:40.884+00:00",{"slug":24,"title":25,"published_at":26},"ransomware-groups-weaponize-legitimate-vmware-tools-to-destroy-backups-before-encrypting","Ransomware Groups Weaponize Legitimate VMware Tools to Destroy Backups Before Encrypting","2026-11-13T11:22:12.372+00:00",{"slug":28,"title":29,"published_at":30},"beast-ransomwares-hidden-control-panel-enables-targeted-encryption-across-networks","Beast Ransomware's Hidden Control Panel Enables Targeted Encryption Across Networks","2026-11-13T09:20:42.408+00:00",{"slug":32,"title":33,"published_at":34},"microsoft-365-global-outage-exposes-gaps-in-resilience-and-configuration-recovery","Microsoft 365 Global Outage Exposes Gaps in Resilience and Configuration Recovery","2026-11-13T08:21:35.526+00:00",{"slug":36,"title":37,"published_at":38},"byod-ransomware-group-claims-vanderbilt-university-breach-locking-databases-and-stealing-ssns","BYOD Ransomware Group Claims Vanderbilt University Breach, Locking Databases and Stealing SSNs","2026-11-10T09:21:24.893+00:00",{"slug":40,"title":41,"published_at":42},"beget-cloud-wiped-management-layer-compromise-destroys-200000-customers-data","Beget Cloud Wiped: Management Layer Compromise Destroys 200,000 Customers' Data","2026-11-09T18:20:46.782+00:00",{"slug":44,"title":45,"published_at":46},"ransomware-shuts-down-queens-public-library-across-66-branches","Ransomware Shuts Down Queens Public Library Across 66 Branches","2026-11-05T23:21:08.6+00:00",{"slug":48,"title":49,"published_at":50},"hyflock-ransomware-exploits-partial-encryption-backups-remain-critical","HYFLOCK Ransomware Exploits Partial Encryption — Backups Remain Critical","2026-11-05T15:22:09.635+00:00",{"slug":52,"title":53,"published_at":54},"immutable-isolated-vaults-are-essential-for-ransomware-resilient-backup-strategy","Immutable, Isolated Vaults Are Essential for Ransomware-Resilient Backup Strategy","2026-11-05T15:20:47.887+00:00",{"slug":56,"title":57,"published_at":58},"queens-public-library-ransomware-attack-shuts-down-public-services","Queens Public Library Ransomware Attack Shuts Down Public Services","2026-11-05T13:21:08.551+00:00",{"slug":60,"title":61,"published_at":62},"beget-hosting-cyberattack-wipes-cloud-data-and-backups","Beget Hosting Cyberattack Wipes Cloud Data and Backups","2026-11-04T14:20:24.292+00:00",{"slug":64,"title":65,"published_at":66},"3am-ransomware-encrypts-37-uk-school-systems-using-ai-assisted-tactics","3AM Ransomware Encrypts 37 UK School Systems Using AI-Assisted Tactics","2026-11-03T17:21:49.855+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",146,{"slug":74,"name":75,"problem":76,"stories":77},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",98,{"slug":79,"name":80,"problem":81,"stories":82},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",66,{"slug":84,"name":85,"problem":86,"stories":87},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",53,{"slug":89,"name":90,"problem":91,"stories":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",39,{"slug":94,"name":95,"problem":96,"stories":97},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",30,[99,105,111,115,120,125,130,134],{"family":100,"item":101,"code":102,"title":103,"together":104},"gdpr","32","Article 32","Security of processing",100,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-800-53","ir-4","IR-4","Incident Handling",88,{"family":112,"item":113,"code":114,"title":114,"together":82},"itil","overview","ITIL",{"family":5,"item":116,"code":117,"title":118,"together":119},"7","Control 7","Continuous Vulnerability Management",65,{"family":106,"item":121,"code":122,"title":123,"together":124},"cp-9","CP-9","System Backup",59,{"family":5,"item":126,"code":127,"title":128,"together":129},"12","Control 12","Network Infrastructure Management",56,{"family":5,"item":131,"code":132,"title":133,"together":87},"17","Control 17","Incident Response Management",{"family":106,"item":135,"code":136,"title":137,"together":87},"si-2","SI-2","Flaw Remediation"]