Skip to content
ControlVerdict
Sign in
MP.L2-3.8.9CMMC Level 2Level 2

Protect Backups

Submit your own example

Practice statement

Protect the confidentiality of backup CUI at storage locations.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.8.9.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(1)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    the confidentiality of backup CUI is protected at storage locations.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    MP.L2-3.8.9Protect Backups
    Protect the confidentiality of backup CUI at storage locations.

    • [a]

      the confidentiality of backup CUI is protected at storage locations.

    Backups encrypted with our own keys, with one immutable copy the domain cannot delete

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses the Protect Backups objective: the confidentiality of backup CUI is protected at storage locations.

    Encryption everywhere it rests. Backup jobs encrypt at the source before data leaves the backup server, so the payload is already ciphertext in flight and at rest in the cloud bucket. Storage-side encryption with customer-managed keys is enabled as well; that is defense in depth rather than the primary control, because provider-managed encryption alone does not protect against a misconfigured bucket policy. Tapes are encrypted by the same job configuration.

    Key custody. Keys live in a managed key service with access limited to two named administrators and the backup service identity, and key use is logged. Recovery key material is escrowed in a sealed dual-control process off the backup infrastructure — losing the keys means losing the backups, so this gets the same care as the backups themselves.

    Access to the backup copies. The backup repository is not domain-joined and does not accept the production administrator credentials; it has its own identity boundary with multifactor authentication. Cloud object storage requires a separate identity with a bucket policy that denies deletion, and object lock keeps a retention hold that even that identity cannot lift within the retention window. The tape set is held in a vault whose release list is three people.

    Confidentiality of restores. Restore requests require an approval and land only in the enclave, never on a technician's workstation or a general-purpose file share — restoring CUI into an unprotected location is the quiet way backup controls get defeated. Test restores follow the same path.

    Verification. Quarterly restore test that includes verifying the restored data is encrypted at the destination and that access is limited to the enclave roster. Monthly check that object lock and the deny-delete policy are still in place, since a well-meaning cleanup script has tried to remove them before.

    Maintenance. Annual review of retention against contract requirements; key rotation on the documented schedule with the old key retained until the last backup encrypted under it ages out.

    Accepted gap. The vaulting provider's staff have physical custody of our tapes. Encryption with keys we hold is the control; the provider cannot read the tapes, and the contract includes audit rights and a chain-of-custody record we reconcile at each rotation.

    What the evidence looks like

    • Backup job configuration showing source-side encryption and the key reference
    • Key service policy showing who may use the key, plus key usage logs
    • Object storage bucket policy with deny-delete and object lock retention settings
    • Quarterly restore test record including the destination access check
    • Vault chain-of-custody record from the last tape rotation

    Environment

    Enclave file data and virtual machines backed up to cloud object storage, with a monthly copy to a vaulted tape set. Ransomware recovery is the scenario that drove the design.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.