Protect the confidentiality of backup CUI at storage locations
📖 What This Means
This control requires organizations to ensure that backup copies of Controlled Unclassified Information (CUI) are properly protected when stored, whether on-site or off-site. This means applying cryptographic mechanisms or equivalent physical safeguards to prevent unauthorized access to backup media. For example, backup tapes stored in a secure facility should be encrypted, or if stored in a vault, the physical security of that vault must be sufficient to protect the confidentiality of the data. This ensures that even if backup media is compromised (stolen, lost, or accessed by unauthorized personnel), the CUI remains protected.
🎯 Why It Matters
Backup copies of CUI are prime targets for adversaries because they often contain complete system-level and user-level information, including sensitive defense data, intellectual property, and personal information. The 2021 Colonial Pipeline ransomware attack highlighted how backup compromise can cripple recovery efforts and lead to millions in losses. For DoD contractors, unprotected backups can result in data breaches that violate CMMC requirements, leading to contract loss and significant fines. According to IBM's Cost of a Data Breach Report, stolen backup media contributed to breaches costing an average of $4.35 million. The DoD requires this control because backup systems are often overlooked in security implementations, yet they provide a complete copy of all CUI—making them extremely valuable to adversaries targeting the defense supply chain.
✅ How to Implement
- 1. Enable encryption at rest for all cloud backup services (AWS Backup, Azure Backup, Google Cloud Storage) using customer-managed keys (CMK).
- 2. Configure backup retention policies in cloud console to automatically encrypt snapshots and archives.
- 3. Use cloud-native key management services (AWS KMS, Azure Key Vault, Google Cloud KMS) to manage encryption keys with proper access controls.
- 4. Enable versioning and replication for backup storage buckets with encryption enabled.
- 5. Implement access logging for backup storage locations using CloudTrail (AWS), Azure Monitor, or Cloud Audit Logs (GCP).
- 6. Set up alerts for unauthorized access attempts to backup storage.
📋 Evidence Examples
Backup Encryption Configuration
Backup Storage Security Policy
Backup Media Inventory
Off-Site Storage Facility Agreement
Backup Access Logs
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For MP.L2-3.8.9 ("Protect the confidentiality of backup CUI at storage locations"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe how CUI on media is protected throughout its lifecycle, including encryption, access controls, marking, transport procedures, sanitization methods, and accountability tracking. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"MP.L2-3.8.9 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to protect the confidentiality of backup cui at storage locations. The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"MP.L2-3.8.9 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to protect the confidentiality of backup cui at storage locations. Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"MP.L2-3.8.9 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify all removable media types within the CUI boundary
- • Document media storage locations (on-site, off-site)
- • Specify media sanitization and destruction methods
- • Ensure this control covers all systems within your defined CUI boundary where protect the confidentiality of backup cui at storage locations applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Media Protection Policy
- 📄 Media inventory database
- 📄 Certificates of destruction
- 📄 Transport chain-of-custody records
- 📄 Evidence artifacts specific to MP.L2-3.8.9
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will check for CUI markings on media, verify encryption is enabled, review the media inventory for completeness, and examine destruction certificates.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Are all backups containing CUI encrypted at rest using FIPS-validated cryptography?
Question 2: Are encryption keys for backup data stored separately from the backup media and properly managed?
Question 3: Are physical backup media (tapes, disks) stored in secured, access-controlled locations?
Question 4: Do you maintain an inventory of all backup media with encryption and storage location documented?
Question 5: Are backup storage access attempts logged and monitored for unauthorized activity?
⚠️ Common Mistakes (What Auditors Flag)
1. Backups are not encrypted, only the primary data is encrypted.
2. Encryption keys stored with the backup media.
3. Off-site backup storage security not verified.
4. Cloud backup snapshots not encrypted.
5. No monitoring or auditing of backup storage access.
📚 Parent Policy
This practice is governed by the Media Protection Policy