Section 500.16(d) requires covered entities to test, at least annually, their ability to restore critical data and information systems from backups, in addition to testing incident response and continuity plans. Prove it with a dated record of what you restored, how long it took, who did it, and what failed.
This is general information, not legal advice.
What the text says
Three connected duties sit in section 500.16:
- Maintain backups necessary to restore material operations, protected from unauthorized alteration or destruction.
- Test the incident response and business continuity plans at least annually with the staff and management critical to the response.
- Test the ability to restore critical data and information systems from backups, also at least annually.
The business continuity plan must also include procedures for backing up information essential to operations with sufficient frequency and storing it offsite.
Design a test that means something
A restore of one small file proves little. A better design:
- Choose a system that matters, such as a customer facing database.
- Restore it to an isolated environment, not over production.
- Start from the backup copy that would be used in a real event, including one held offsite.
- Verify integrity: checksums, row counts, an application level smoke test.
- Time each stage and compare against the recovery time objective in your asset inventory.
If your objectives were never measured, this is the first time you learn the real number.
What to record
| Item | Why it matters |
|---|---|
| Date and participants | Shows the annual test happened and who took part |
| Systems and backup sets used | Shows the scope was critical data |
| Elapsed times | Compares reality with objectives |
| Verification method and result | Shows data was usable, not just present |
| Failures and fixes | Shows learning and follow through |
| Approval of results | Links to CISO oversight |
Protect backups from the same attacker
Ransomware plans often fail because backups were reachable from the compromised environment. Section 500.16(e) asks that backups be adequately protected from unauthorized alterations or destruction. Separate credentials, immutability features where available, and offsite copies are the usual answers. Test that the backup credentials are not the same ones an attacker could take from production.
Mistakes to avoid
Backup programs fail quietly. Jobs report success while the data is unusable. Restores work for the database but not for the secrets and configuration needed to run it. The restore is tested once, then the architecture changes. Encryption keys are stored only in the system being restored. Verify integrity after each test, include configuration and keys in the scope, repeat the test after major architecture changes, and keep a copy of keys somewhere that survives the incident.
Quick check
Can a tabletop exercise replace the restore test?
No. The rule lists testing of incident response and continuity plans and, separately, testing the ability to restore critical data and systems from backups.
Do I need to restore everything every year?
The text says critical data and information systems. Scope is a risk decision that you should document.
Sources
- 23 NYCRR 500.16, Incident response and business continuity management
- 23 NYCRR 500.13, Asset management and data retention requirements
Last reviewed: 19 October 2026.
