How do backups support the Protect function?
- A.Regular, tested backups of data and system configurations protect against data loss from ransomware, hardware failures, human error, and other destructive events, ensuring recovery capability
- B.Configuration baselines that define an approved secure state, and that trigger an alert whenever a monitored system drifts during a scheduled scan
- C.Access reviews conducted quarterly, and that require managers to reconfirm each direct report's current permission set in the identity governance tool
- D.Vulnerability scans run continuously, and that generate a prioritized remediation list reviewed by the security team each week
Why A is correct
Backups are a protective control that ensures data availability. When combined with offline/immutable storage, they protect against ransomware and provide the foundation for recovery.
Know someone studying for NIST CSF? Send them this one.