03.08.09: Protect Backups

Beyond CMMC Level 1

The free web app covers the 17 CMMC Level 1 practices. This requirement is part of the full NIST 800-171 set — get the desktop app to work on all 110 requirements with SPRS scoring. Previously saved data is shown read-only below, and your data always remains exportable in full.

Get the desktop app

Security Requirements for 03.08.09 Protect Backups

Organizations can employ cryptographic mechanisms or alternative physical controls to protect the confidentiality of backup information at designated storage locations. Backed-up information containing CUI may include system-level information and user-level information. System-level information includes system-state information, operating system software, application software, and licenses. User-level information includes information other than system-level information.

Assessment GuidanceExamine 0/6

How an assessor determines this requirement is met. Source: CMMC Assessment Guide – Level 2, Version 2.13 (NIST SP 800-171 Rev. 2).

Discussion

You protect CUI to ensure that it remains private (confidentiality) and unchanged (integrity). Methods to ensure confidentiality may include:

encrypting files or media;

managing who has access to the information; and

physically securing devices and media that contain CUI.

Storage locations for information are varied, and may include:

external hard drives; USB drives;

magnetic media (tape cartridge); optical disk (CD, DVD);

Networked Attached Storage (NAS); servers; and

cloud backup.

This requirement, MP.L2-3.8.9, requires the confidentiality of backup information at storage locations.

Examples

Example 1
You are in charge of protecting CUI for your company. Because the company’s backups contain CUI, you work with IT to protect the confidentiality of backup data. You agree to encrypt all CUI data as it is saved to an external hard drive [a].

Assessment Methods

Examine

The process of reviewing, inspecting, observing, studying, or analyzing assessment objects (e.g., policies, procedures, plans, system designs, mechanisms) to facilitate understanding, achieve clarification, or obtain evidence.Example: An assessor reads the access control policy and inspects system configuration settings to confirm they match.

Not all of the evidence listed is required to meet this requirement — check the items your organization has collected.

Procedures addressing system backup
System configuration settings and associated documentation
Security plan
Backup storage locations
System backup logs or records
Other relevant documents or records

Interview

The process of holding discussions with individuals or groups within an organization to facilitate understanding, achieve clarification, or identify the location of evidence.Example: An assessor asks a system administrator to describe how user accounts are approved, reviewed, and disabled.

Personnel with system backup responsibilities
Personnel with information security responsibilities

Test

The process of exercising assessment objects (e.g., activities, mechanisms) under specified conditions to compare actual behavior with expected behavior.Example: An assessor attempts to sign in with a disabled account to confirm that access is denied.

Organizational processes for conducting system backups
Mechanisms supporting or implementing system backups

Potential Assessment Considerations

Are data backups encrypted on media before removal from a secured facility [a]?
Are cryptographic mechanisms FIPS validated [a]?

Key References

NIST SP 800-171 Rev. 2 3.8.9

Overview