CMMC Practice MP.L2-3.8.9 – Protect Backups: Protect the confidentiality of backup CUI at storage locations.
Links to Publicly Available Resources
This comprehensive data backup blog explains what a data backup is, why every organization needs one, and some data backup options to consider. This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2. Gartner product listing and reviews of data backup and recovery solutions Here are eight ways to protect your organization’s backup data from ransomware attacks. NIST resource that defines requirements for system backup activities. This article breaks down CMMC Section 3.8, which focuses on the media protection for media that contains controlled unclassified information (CUI) A comprehensive guide to planning, developing and executing a successful data backup strategy. This GSA-IT Security MP Procedurals reference provides guidance for the MP security controls identified in NIST SP 800-53 and federal contractor media protection requirements. This paper summarizes the pros, cons, and security considerations of backup options for critical personal and business data. A comprehensive guide to data backups within your business’s disaster recovery plan.
Discussion [NIST SP 800-171 R2]
Organizations can employ cryptographic mechanisms or alternative physical controls to protect the confidentiality of backup information at designated storage locations. Backed-up information containing CUI may include system-level information and user-level information. System-level information includes system-state information, operating system software, application software, and licenses. User-level information includes information other than system-level information.
Further Discussion
You protect CUI to ensure that it remains private (confidentiality) and unchanged (integrity). Methods to ensure confidentiality may include:
- encrypting files or media;
- managing who has access to the information; and
- physically securing devices and media that contain CUI.
Storage locations for information are varied, and may include:
- external hard drives;
- USB drives;
- magnetic media (tape cartridge);
- optical disk (CD, DVD);
- Networked Attached Storage (NAS);
- servers; and
- cloud backup
This practice, MP.L2-3.8.9, requires the confidentiality of backup information at storage locations.