aws_compliance

AWS Compliance

Checks if a backup vault has an attached resource-based policy which prevents deletion of recovery points. The rule is non-compliant if the Backup Vault does not have resource-based policies or has policies without a suitable 'Deny' statement.

backup_recovery_point_manual_deletion_disabled

pci_dss_v321_requirement_10_7_a

10.7.a Examine security policies and procedures to verify that they define audit log retention policies and procedures for retaining audit logs for at least one year, with a minimum of three months immediately available online

gxp_21_cfr_part_11_11_10_a

11.10(a) Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records

gxp_eu_annex_11_operational_phase_16

16 Business Continuity

hipaa_final_omnibus_security_rule_2013_164_308_a_7_i

164.308(a)(7)(i) Contingency plan

hipaa_security_rule_2003_164_308_a_7_i

hipaa_security_rule_2003_164_308_a_7_ii_a

164.308(a)(7)(ii)(A) Data backup plan

hipaa_final_omnibus_security_rule_2013_164_308_a_7_ii_a

hipaa_final_omnibus_security_rule_2013_164_308_a_7_ii_b

164.308(a)(7)(ii)(B) Disaster recovery plan

hipaa_security_rule_2003_164_308_a_7_ii_b

hipaa_security_rule_2003_164_308_a_7_ii_c

164.308(a)(7)(ii)(C) Emergency mode operation plan

hipaa_final_omnibus_security_rule_2013_164_308_a_7_ii_c

hipaa_final_omnibus_security_rule_2013_164_310_d_2_iv

164.310(d)(2)(iv) Data backup and storage

hipaa_security_rule_2003_164_310_d_2_iv

hipaa_security_rule_2003_164_312_a_2_ii

164.312(a)(2)(ii) Emergency access procedure

hipaa_final_omnibus_security_rule_2013_164_312_a_2_ii

gxp_eu_annex_11_operational_phase_17

17 Archiving

pci_dss_v321_requirement_3_1_c

3.1.c For a sample of system components that store cardholder data examine files and system records to verify that the data stored does not exceed the requirements defined in the data retention policy and observe the deletion mechanism to verify data is deleted securely

nist_800_171_rev_2_3_13_2

3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems

nist_800_171_rev_2_3_8_9

3.8.9 Protect the confidentiality of backup CUI at storage locations

gxp_eu_annex_11_project_phase_4_8

4.8 Validation - Data Transfer

gxp_eu_annex_11_operational_phase_5

5 Data

nydfs_23_500_02_b_5

500.02(b)(5)

gxp_eu_annex_11_operational_phase_7_2

7.2 Data Storage - Backups

rbi_itf_nbfc_8_IX

8.IX Backup and Recovery

soc_2_a_1_2

A1.2 The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure to meet its objectives

acsc_essential_eight_ml_2_5_2

ACSC-EE-ML2-5.2: Restrict administrative privileges ML2

acsc_essential_eight_ml_2_5_3

ACSC-EE-ML2-5.3: Restrict administrative privileges ML2

acsc_essential_eight_ml_2_8_6

ACSC-EE-ML2-8.6: Regular backups ML2

acsc_essential_eight_ml_2_8_8

ACSC-EE-ML2-8.8: Regular backups ML2

acsc_essential_eight_ml_3_5_2

ACSC-EE-ML3-5.2: Restrict administrative privileges ML3

acsc_essential_eight_ml_3_5_3

ACSC-EE-ML3-5.3: Restrict administrative privileges ML3

acsc_essential_eight_ml_3_8_6

ACSC-EE-ML3-8.6: Regular backups ML3

acsc_essential_eight_ml_3_8_8

ACSC-EE-ML3-8.8: Regular backups ML3

all_controls_backup

Backup

soc_2_cc_7_4

CC7.4 The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate, and communicate security incidents, as appropriate

ffiec_d_1_rm_rm_b_1

D1.RM.Rm.B.1

nist_csf_pr_ip_9

PR.IP-9

nist_csf_rc_rp_1

RC.RP-1

nist_csf_rs_rp_1

RS.RP-1

cisa_cyber_essentials_your_data_5

Your Data-5

cisa_cyber_essentials_your_systems_3

Your Systems-3

Backup recovery points manual deletion should be disabled

Run individual configuration, compliance and security controls or full compliance benchmarks for CIS, FFIEC, PCI, NIST, HIPAA, RBI CSF, GDPR, SOC 2, Audit Manager Control Tower, FedRAMP, GxP and AWS Foundational Security Best Practices controls across all your AWS accounts using Powerpipe and Steampipe.

Apache License 2.0

steampipe-mod-aws-compliance

Control: Backup recovery points manual deletion should be disabled

Description

Usage

SQL

Tags