Recovery Policy
Recovery Domain (RE)
📖 What This Policy Covers
Recovery ensures you can bounce back from disasters, ransomware, hardware failures, and data corruption. This policy covers backup frequency and types (full, incremental, differential by system type), backup storage tiers (on-site, off-site, cold storage), backup encryption and access controls, backup testing and validation (quarterly restore tests), Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), disaster recovery site capabilities (cloud-based hot/warm standby), and DR plan testing (annual tabletop + failover test).
Purpose
This policy ensures CUI data is backed up regularly with appropriate protection, backups are tested to verify they can be restored, CUI confidentiality and integrity are maintained during backup operations, and alternate processing capabilities exist for disaster recovery.
Scope
Applies to all systems, databases, file servers, endpoints, virtual machines, and cloud infrastructure that process, store, or transmit CUI. Covers backup operations, restore procedures, disaster recovery planning, and business continuity.
🎯 Why It Matters
Ransomware is the #1 threat to defense contractors. Without tested backups, a ransomware attack can result in permanent CUI data loss and contract termination. The average cost of ransomware recovery is $1.82M (Sophos 2023). Assessors specifically test whether you can actually restore from backups -- having backups that have never been tested is a common finding. Your RTO determines how long your business is down; your RPO determines how much data you lose.
🔐 Key Requirements
1. Backup and Restore
Regular backups of all CUI systems with defined frequency and retention.
- ✓ Databases: daily full + hourly incremental
- ✓ File servers: daily full + hourly incremental
- ✓ Endpoints: weekly full + daily incremental (cloud backup: OneDrive, Google Drive)
- ✓ VMs: daily snapshots
- ✓ Cloud infrastructure: continuous replication (S3 versioning, Azure geo-redundant storage)
- ✓ Primary storage: on-site (NAS, SAN)
- ✓ Secondary: off-site cloud (AWS S3, Azure Blob, Backblaze)
- ✓ Tertiary: cold storage (AWS Glacier, tape at Iron Mountain)
- ✓ Retention: daily 30 days, monthly 12 months, annual 7 years
- ✓ All backups encrypted at rest (AES-256) and in transit (TLS 1.2+)
2. Backup Testing
Regular testing to verify backups can be restored within RTO/RPO targets.
- ✓ Quarterly restore tests for critical CUI systems, annually for all systems
- ✓ Test scope: restore sample files/databases, verify integrity, test accessibility
- ✓ Document: test date, systems tested, restore time, success/failure, issues
- ✓ RTO targets: critical CUI systems 4 hours, important CUI 24 hours, other 72 hours
- ✓ RPO targets: critical databases 1 hour max data loss, file servers 24 hours, endpoints 7 days
3. Backup Security
Protect CUI during backup operations.
- ✓ Only authorized backup administrators can access backup systems
- ✓ Encryption: AES-256 for all backups
- ✓ Integrity verification via checksums and restore tests
- ✓ Backup accounts separate from production (prevent ransomware from encrypting backups)
- ✓ Immutable backups in cloud (cannot be deleted for X days) to protect against ransomware
- ✓ All backup/restore activities logged
- ✓ Off-site tapes at secure facility (Iron Mountain), geo-redundant cloud backups
4. Disaster Recovery
Alternate processing site and disaster recovery plan.
- ✓ DR site type: cloud-based (AWS, Azure hot/warm standby) or colocation
- ✓ Same security controls as primary site (firewalls, MFA, encryption)
- ✓ Continuous or near-real-time data replication to DR site
- ✓ Annual DR failover test
- ✓ DR plan: system prioritization, step-by-step recovery runbooks, contact lists, communication plan
- ✓ Annual tabletop exercise + actual failover test
- ✓ Post-test: document lessons learned, update DR plan
👥 Roles & Responsibilities
CISO / IT Director
- • Approve backup and DR strategy
- • Review backup test results
- • Approve RTO/RPO targets
- • Own DR plan and ensure annual testing
IT Operations / Backup Administrators
- • Configure and maintain backup systems
- • Execute daily backup monitoring
- • Perform restore tests per schedule
- • Maintain DR site readiness
IT Security
- • Verify backup encryption and access controls
- • Monitor backup logs for anomalies
- • Ensure backup accounts are separate from production
- • Participate in DR tabletop exercises
System/Application Owners
- • Define RTO/RPO requirements for their systems
- • Participate in restore testing
- • Validate restored data integrity
- • Participate in DR exercises
🛠️ Implementation Roadmap (8 Weeks)
Backup Deployment
Weeks 1-2- → Select backup solution (Veeam, Commvault, cloud-native)
- → Size storage requirements (calculate based on data volume + growth + retention)
- → Deploy backup agents to all CUI systems
- → Configure backup jobs per frequency requirements
Backup Testing
Weeks 3-4- → Test initial backups: restore sample files and databases
- → Verify data integrity after restore
- → Document restore time and compare to RTO targets
- → Configure backup monitoring and alerting
Off-site & DR
Weeks 5-6- → Establish off-site backup storage (cloud or physical)
- → Configure replication to secondary site
- → Set up immutable backup configuration (S3 Object Lock, Azure immutability)
DR Planning & Testing
Weeks 7-8- → Document DR plan with runbooks, contact lists, system priorities
- → Conduct tabletop exercise with IT team and stakeholders
- → Document lessons learned and update plan
Recommended Tools
📊 CMMC Practice Mapping
| Practice ID | Requirement | Policy Section |
|---|---|---|
| RE.L2-3.14.1 | Establish recoverable system configurations | 1 |
| RE.L2-3.14.2 | Perform and document backups | 1, 3 |
| RE.L2-3.14.3 | Regularly test backup information | 2 |
| RE.L2-3.14.4 | Provide alternate storage/processing sites | 4 |
📋 Evidence Requirements
These are the artifacts a C3PAO assessor will ask for. Start collecting early.
Backup Configuration Screenshots
Backup Success Reports
Restore Test Documentation
Disaster Recovery Plan
DR Test Report
⚠️ Common Gaps (What Assessors Flag)
1. Backups exist but have never been tested
2. Backups not encrypted
3. No immutable backups (ransomware risk)
4. No DR plan or DR site
📝 Template Customization Guide
When filling in the downloadable template for this policy, replace these placeholders with your organization's specifics:
[COMPANY NAME] Your organization's legal name
Example: Acme Defense Systems, LLC
[CISO Name] Name of your CISO or COO
Example: Jane Smith
Customization Tips
- 💡 Specify your actual RTO/RPO targets based on business requirements and contract SLAs
- 💡 Document your specific backup software and cloud storage providers
- 💡 Include your DR site location and capabilities
- 💡 If you're fully cloud-native, describe how cloud-native backup and multi-region deployment meets DR requirements
- 💡 Adjust backup frequency based on your data change rate and acceptable data loss