This control requires organizations to ensure that backups containing Controlled Unclassified Information (CUI) are protected with appropriate security measures—especially when stored off-site or in long-term archival systems.
Read the full blog breakdown of 3.8.9