Untested backups: what HIPAA and CIS expect you to prove

A backup that has never been restored is not a control. It's an assumption — that the job which reported success actually captured usable data, that someone still has the credentials needed to run a restore, and that what comes back actually works, inside the time the business can tolerate losing it. Regulated organizations are asked, in writing, to close that gap. Here's what 45 CFR 164.308 (HIPAA's Security Rule), the CIS Controls, and NIST's federal contingency-planning guidance say — in their own words — about proving a backup and disaster recovery plan actually works.

What HIPAA's contingency plan standard actually says

45 CFR 164.308(a)(7)(i) sets the Standard: Contingency plan. "Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information." Under that standard, the regulation lists five implementation specifications — three Required, two Addressable:

• Data backup plan (Required). "Establish and implement procedures to create and maintain retrievable exact copies of electronic protected health information."
• Disaster recovery plan (Required). "Establish (and implement as needed) procedures to restore any loss of data."
• Emergency mode operation plan (Required). "Establish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of electronic protected health information while operating in emergency mode."
• Testing and revision procedures (Addressable). "Implement procedures for periodic testing and revision of contingency plans."
• Applications and data criticality analysis (Addressable). "Assess the relative criticality of specific applications and data in support of other contingency plan components."

Read plainly: you're required to have a backup plan, a way to restore from it, and a way to keep critical processes running while you do. You're required to address testing and revising that plan. What the text doesn't say is how often, or what "tested" has to mean — that's left to you, which is exactly where organizations quietly do nothing.

What "Addressable" does and doesn't tell you, from this text alone

Within this one standard, the regulation itself draws the line: (A), (B), and (C) are labeled "Required." (D) and (E) are labeled "Addressable." What defines that distinction — whether an Addressable specification can be skipped, and under what conditions — lives elsewhere in HIPAA's Security Rule, outside 164.308(a)(7) itself, and we won't characterize that text here. What this section states directly: testing and revision of the contingency plan isn't in the same category as the three plans marked Required without qualification — but it's still a named implementation specification under a standard every covered entity and business associate must implement.

CIS Controls: turning "test it" into a number

CIS Critical Security Control 11, Data Recovery — per CIS Controls v8.1 — states the overview goal plainly: "Establish and maintain data recovery practices sufficient to restore in-scope enterprise assets to a pre-incident and trusted state." Safeguard 11.5, Test Data Recovery — per the CIS Controls Assessment Specification for Controls v8 — is a specific interval you can adopt: "Test backup recovery quarterly, or more frequently, for a sampling of in-scope enterprise assets."

The CIS Controls Assessment Specification defines what passing means: restore a sample of backups to a temporary location, then count what came back. The measures:

• M1 = Count of backups being tested
• M2 = Count of properly working backups after restoration
• M3 = Count of backups not properly working after restoration
• M4 = Timeframe between tests of backup recovery

And the scoring has a hard gate built in: "If M4 is greater than three months, then this safeguard is measured at a 0 and receives a failing score. The other metrics don't apply." A perfect restore rate from eight months ago doesn't count. The Backup Integrity Quality metric itself is simply M2 divided by M1 — the percentage of the sample that actually worked once restored, not the percentage of jobs that reported success.

NIST SP 800-34: how you actually exercise the plan

NIST's Contingency Planning Guide for Federal Information Systems (SP 800-34 Rev. 1) describes two exercise types. A tabletop exercise is "discussion-based only and does not involve deploying equipment or other resources" — personnel meet to talk through roles and responses to a scenario a facilitator presents. A functional exercise is different in kind: it lets "personnel validate their operational readiness for emergencies by performing their duties in a simulated operational environment," exercising the specific team members, procedures, and assets involved.

NIST is specific about when a tabletop stops being enough: for moderate-impact systems, a functional exercise should be conducted, and "Exercise procedures should be developed to include an element of system recovery from backup media." For high-impact systems, NIST calls for "a full-scale functional exercise" including "a system failover to the alternate location" — which may include, for example, "recovery of a server or database from backup media or setup, and processing from a server at an alternate location." The high-impact test should also include "a full recovery and reconstitution of the information system to a known state." And whatever the exercise type: "all tests and exercises should include some kind of determination of the effects on the organization's operations and provide for a mechanism to update and improve the plan as a result." A test that doesn't change the plan when something fails wasn't a test.

What a real restore test looks like for a mid-market shop

Put the three sources together and a working program looks less like paperwork and more like a checklist you can actually run:

• Sample restores to an isolated location. CIS's own operation: restore a sampling of backups to a temporary location, not production, so a bad restore can't become an incident of its own.
• Verify the restored thing actually works — not just that the job succeeded. CIS separates "properly working after being restored" from "did not properly work after being restored" as two distinct counts. A green backup job and a working restore are different facts.
• Time it against what the business says it needs. NIST ties exercise depth to the system's impact level — moderate gets a functional exercise with an actual recovery from backup media, high gets full reconstitution. Run the test against that system's actual recovery expectations, not a generic schedule applied everywhere.
• Include the identity and credentials the restore actually needs. A test that only proves the media is readable, and never exercises who has access to invoke it, hasn't tested the whole procedure — the credentials are part of the plan, not an assumption underneath it.
• Record the result, and fix what failed. NIST's own language: provide "a mechanism to update and improve the plan as a result." CIS's M4 measure exists because an undated test is indistinguishable from no test at all.

Why auditors and insurers keep asking for this

Backup consoles are administrative infrastructure with broad reach into what they protect — the same management-plane risk we cover in our RMM-is-Tier-0 post: who holds standing access, and what limits the blast radius if that access is misused. A documented, dated restore test is also the kind of evidence cyber-insurance underwriters and auditors increasingly ask for at renewal rather than a "we have backups" attestation, a shift we cover in our cyber-insurance readiness post. None of the three posts claims HIPAA mandates a testing frequency. All three agree that "we have backups" and "we tested a restore, on this date, and it worked" are different claims, and only one is evidence.

Related reading

• Cyber-insurance readiness for the mid-market (2026) — what underwriters verify at renewal, including backup and restore evidence.
• Your provider's RMM is Tier 0: 8 questions — why the platform managing your backups is itself a high-value target.
• Backup & disaster recovery implementation service page.

Sources

• eCFR — 45 CFR 164.308, Administrative safeguards
• GovInfo — 45 CFR 164.308, 45 CFR Subtitle A (10–1–25 Edition)
• CIS — Critical Security Control 11: Data Recovery
• CIS Controls Assessment Specification — 11.5: Test Data Recovery
• NIST SP 800-34 Rev. 1 — Contingency Planning Guide for Federal Information Systems

The 30-second version

HIPAA's 45 CFR 164.308(a)(7) requires a data backup plan, a disaster recovery plan, and an emergency mode operation plan — all three Required. Testing and revision of that plan is Addressable, and the regulation names no frequency; HIPAA doesn't mandate quarterly testing. CIS Controls v8 Safeguard 11.5 fills that gap with a number: test backup recovery quarterly, restore to a temporary location, count what actually works versus what doesn't, and treat anything older than three months as a failing score. NIST SP 800-34 describes how to run the exercise — tabletop for discussion, functional for an actual recovery from backup media — and insists every test feed back into an updated plan. Put together: sample restores, verify they work, time them against what the business needs, include the credentials the restore requires, and record what failed.

We don't resell hardware or software. When a project needs procurement, we recommend the right products for your environment, work with the vendor of your choice on quoting, and handle install, configuration, and integration — no margin in either direction. If you want us to set up and run a restore-testing program on whatever backup platform you already have, the project intake form takes about three minutes. We'll come back with scope and a fixed-fee range.

Pro IT NW is a senior-led, labor-only Microsoft consultancy in the Seattle area. We engineer and test backup and disaster recovery programs for regulated mid-market organizations — vendor-neutral, no resale. This post quotes 45 CFR 164.308, CIS Controls v8 and v8.1, and NIST SP 800-34 directly; it is not legal or compliance advice, and it does not certify HIPAA compliance.