Guide
Building a Security Program from Scratch
A ninety-day sequence for a business with nothing written down yet — cheapest, highest-impact work first.
Beginner
14 min
Free
NIST CSF
CIS Controls
Published · v1.0.0 · 2026-08-01
Template
Backup Verification Log
Proof that backups exist, run, and have actually been restored at least once.
- Intended audience
- Whoever owns IT operations
- Difficulty
- Beginner
- Estimated time
- 15 minutes
- Access
- Free
NIST CSF
CIS Controls
All industries
Version v1.0.0 · Last reviewed 2026-08-01 · Document owner: ComplianceAnvil Content Team
What you will be able to do
- Capture the columns needed to prove backups run and are retained appropriately.
- Record restore test dates and results, not just backup completion.
- Understand why an untested backup should be treated as an unverified assumption.
Columns to capture
- System backed up and backup destination.
- Frequency and retention.
- Last successful backup date.
- Last restore test date and result.
- Tester name and notes.
The point
An untested backup is an assumption. One recorded restore per year turns it into a control.
Key takeaways
- A backup log needs to record frequency and retention for each system backed up, not just the fact that backups exist.
- Recording the last successful backup date shows whether the backup process is actually running as expected.
- A restore test date and result is what separates a working backup from an assumption that it works.
- Naming the tester and their notes on each restore test creates an accountable, reviewable record.
- At least one recorded, successful restore test per year turns backups from an assumption into a verified control.
Sources
Written from these public, authoritative publications. ComplianceAnvil paraphrases and summarizes them; it does not reproduce copyrighted control text.
NIST · 2.0
Cybersecurity Framework (CSF) 2.0(opens in a new tab)Link last confirmed 2026-02-01
How this was written and reviewed
Published
- Author
- ComplianceAnvil Editorial Team
- Technical reviewer
- ComplianceAnvil Technical Review Board
- Jurisdiction
- United States (federal)
- First published
- 2026-08-01
- Last reviewed
- 2026-08-01
- Next review due
- 2027-08-01
Version v1.0.0 · Document owner: ComplianceAnvil Content Team
Important
This template is provided for readiness and educational purposes. Organizations should review and adapt it for their environment.
Related resources
Matched on shared frameworks, topics, and program packs.
Checklist
Cybersecurity Self-Assessment Checklist
A fast, honest look at your current security posture across identity, devices, data, people, and response.
Beginner
25 min
Free
NIST CSF
CIS Controls
Published · v1.0.0 · 2026-08-01
Checklist
Small Business Security Checklist
The thirty-day baseline: the controls that stop the majority of small-business incidents, ordered by impact.
Beginner
30 min
Free
NIST CSF
CIS Controls
Published · v1.0.0 · 2026-08-01
Exercise
Build Your First Asset Inventory
Practice building an inventory from a realistic ten-person business, then apply the same pattern to your own.
Beginner
20 min
Free
CIS Controls
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Guide
Common Compliance Mistakes
The recurring, expensive errors we see small businesses make — and the cheap correction for each.
Beginner
9 min
Free
NIST CSF
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Exercise
Complete a Readiness Scorecard
Score yourself honestly across six areas and turn the two lowest into a short plan.
Beginner
15 min
Free
NIST CSF
Published · v1.0.0 · 2026-08-01
Put this into practice
Resources tell you what good looks like. A Program Pack does the work with you — generated documentation, tracked controls, training, and evidence in one workspace.