What is the data backup requirement in CTPAT?

• A. Backups must be performed daily.
• B. Data backups are not required.
• C. Regular data backup must be conducted.
• D. Backups must be encrypted.

Answer: (C)

In CTPAT, protecting information and ensuring business continuity means you back up data on a regular basis. The requirement is that regular data backups are conducted, establishing a routine for copying critical data, storing those copies securely, and being able to restore operations after an interruption. The exact frequency isn’t mandated as daily in general guidance; it should fit the organization’s risk, data criticality, and recovery objectives. Encryption of backups is a strong security control and may be needed in other standards, but the responsibility highlighted here is to perform backups on a regular schedule.