Cloud SQL instances should have automated backups configured
Checks that Cloud SQL database instances have backup configuration enabled. Kics checks if backup configuration is enabled for all Cloud SQL Database instances. Prowler checks for automated backups configured to run on a schedule.
Absent automated backups, unintended deletes, corruption, or ransomware can become irreversible. This degrades data integrity and availability, removes point-in-time recovery options, and widens RPO / RTO, causing prolonged outages and incomplete restoration after incidents or schema changes.
What this control checks
Cloud SQL instances must have backup_configuration enabled (automated backups configured).
Common pitfalls
Replicas with master_instance_name return UNKNOWN
Checkov CKV_GCP_14 returns UNKNOWN when master_instance_name is in the configuration.
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudsql_instance_automated_backups (prowler gcp --checks cloudsql_instance_automated_backups); PowerPipe control gcp_compliance.control.sql_instance_automated_backups_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_14; KICS query "SQL DB Instance Backup Disabled" (cf3c7631-cd1e-42f3-8801-a561214a6e79).
Framework-specific interpretation
SOC 2: Mapped to CC7.5 (The entity identifies, develops, and implements activities to recover from identified security incidents) and PI1.5 (Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's...).
ISO/IEC 27001:2022: Mapped to A.8.13 (Information Backup).
NIS2 Directive (EU 2022/2555): Mapped to 12.1.2.c (align the availability requirements of the assets with the delivery and recovery objectives set out in their business...), 4.1.1 (For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities shall lay down and...), 4.1.2.f (recovery plans for specific operations, including recovery objectives;) and 4 more clauses.
NIST Cybersecurity Framework v2.0: Mapped to PR.DS-01 (The confidentiality, integrity, and availability of data-at-rest are protected.), PR.DS-11 (Backups of data are created, protected, maintained, and tested.), PR.IR-02 (The organization's technology assets are protected from environmental threats.) and 5 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- CC7.5 The entity identifies, develops, and implements activities to recover from identified security incidents
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- A.8.13 Information backup
- 4 Business continuity and crisis management
- 12 Asset management
NIST Cybersecurity Framework v2.0
- PR.DS-01
- PR.DS-11: Backups of data are created, protected, maintained, and tested.
- PR.IR-02
- PR.IR-03
- PR.IR-04
3 more clauses
- RC.RP-02
- RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration.
- RC.RP-05
- 6.7 Ensure That Cloud SQL Database Instances Are Configured With Automated Backups
- 6.7 Ensure That Cloud SQL Database Instances Are Configured With Automated Backups
- AM-09.01B Assets are classified and, if possible, labelled. Classification and labelling of an asset reflect the protection needs of the category of cloud service customer data, cloud service derived data, cloud service provider data and account data it processes, stores, or transmits.
- BCM-01.02B Policies and instructions for establishing the strategy and guidelines to ensure business continuity management for the cloud service are documented, communicated and provided in accordance with SP-01.
- BCM-01.05B Policies and instructions related to business impact analyses and business continuity plans are documented, communicated and made available in accordance with SP-01.
- CRY-05.01B The cloud service provider has established procedures and technical safeguards to encrypt cloud service customer data during storage (i.e. at rest).
- DEV-11.02B The cloud service provider includes the development environment as part of the backup plan in accordance with the backup concept (cf. OPS-06).
6 more clauses
- OIS-08.09B The cloud service provider documents and implements a risk treatment plan based on the risk assessment (OIS-07).
- OPS-06.01B Policies and instructions for at least daily backup and restore of cloud service customer data, cloud service derived data and cloud service provider data according to the sensitivity of the data are documented, communicated and provided in accordance with SP-01 regarding the...
- OPS-07.01B The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is monitored by technical and organisational measures documented and implemented in accordance with the policies and instructions defined in OPS-06.
- OPS-08.01B Restore procedures are tested regularly, at least annually. The tests include cloud service customer data, cloud service derived data and cloud service provider data in accordance with the contractual agreements.
- OPS-08.03B Cloud service customer data is only restored in environments that are subject to the same access restrictions as the production environment.
- OPS-09.02B The data classification of the original data is applied to backups.
- 6.7 Ensure that Cloud SQL database instances are configured with automated backups
- 6.7 Ensure that Cloud SQL database instances are configured with automated backups
- 6.7 Ensure that Cloud SQL database instances are configured with automated backups
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(7)(i) Contingency plan
- 164.308(a)(7)(ii) Implementation specifications
- 164.308(a)(7)(ii)(A) Data backup plan
- 164.308(a)(7)(ii)(B) Disaster recovery plan
2 more clauses
- 164.312(c)(1) Integrity
- 164.312(e)(2)(i) Integrity controls
NIST Cybersecurity Framework v1.0
- PR.IP-4: Backups of information are conducted, maintained, and tested.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_automated_backups_enabled - Checkov Check:
CKV_GCP_14 - Powerpipe Control:
gcp_compliance.control.sql_instance_automated_backups_enabled - Prowler Check:
cloudsql_instance_automated_backups - KICS Query:
cf3c7631-cd1e-42f3-8801-a561214a6e79
Last reviewed: 2026-10-10