Core / Core / Controls / v2026.11
Maintain Recent Backups
CCC.Core.CN14 · Data Resilience
Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.Core.CP11 | Backup | The service can generate copies of its data or configurations in the form of automated backups, snapshot-based backups, or incremental backups. |
| CCC.Core.CP18 | Resource Versioning | The service automatically assigns versions to child resources which can be used to preserve, retrieve, and restore past iterations. |
| CCC.Core.CP32 | Deletion Protection | The service may be configured to block the deletion of a child resource, or to retain a deleted child resource for a recovery window during which it can be restored. |
| CCC.Core.CP34 | Data Lifecycle Policy | The service may be configured to automatically delete, archive, or transition data or child resources once a user-defined age or condition is reached. |
Related Threats
| ID | Title | Description |
|---|
| CCC.Core.TH06 | Data is Lost or Corrupted | Services that rely on accurate data are susceptible to disruption in the event of data loss or corruption. Any actions that lead to the unintended deletion, alteration, or limited access to data can impact the availability of the service and the system it is part of. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.Core.CN14.AR01 | When backups are created for disaster recovery purposes, the storage mechanism MUST NOT allow modification or deletion within 30 days of creation. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.Core.CN14.AR02 | When backups are created for disaster recovery purposes, the most recent backup MUST have a creation date within the past 30 days. | tlp-clear, tlp-green, tlp-amber |
| CCC.Core.CN14.AR03 | When backups are created for disaster recovery purposes, the most recent backup MUST have a creation date within the past 14 days. | tlp-red |