Mapped to NIST 800-171 Requirement: 3.8.9
CMMC Assessment Objective: MP.L2-3.8.9
What This Control Means
Your organization must apply confidentiality protections to all backup data that contains CUI, regardless of where it’s stored:
• On-premises backup servers
• Offsite physical media (e.g., tapes, drives)
• Cloud backup services (e.g., AWS, Azure, Veeam, Datto)
Protections must include encryption, access control, and physical or virtual security measures to prevent unauthorized access, loss, or data compromise.
Why It Matters
Backups are a common target for cyberattacks, and also a frequent source of accidental data exposure. Risks include:
• Unauthorized access to unencrypted backups
• Improperly stored portable backup drives
• Insecure cloud configurations
• Incomplete separation between production and backup systems
Failing to protect backup CUI can result in total loss of confidentiality even if the primary system is secure.
How to Implement It
1. Encrypt All Backup Media
• Use AES-256 or equivalent encryption for:
◦ Disk-based backups
◦ Cloud backups
◦ Portable backup drives or tapes
2. Restrict Access to Backup Systems
• Apply RBAC or least privilege access to:
◦ Backup software
◦ Storage volumes
◦ Offsite vaults or recovery portals
3. Secure Physical Storage Locations
• Store portable backups in:
◦ Locked rooms or cabinets
◦ Facilities with physical access control
◦ Vaults, safes, or secured data centers
4. Validate Cloud Security Configurations
• Use FedRAMP or DoD-approved cloud platforms if possible
• Apply proper IAM roles, encryption in transit & at rest, and audit logging
5. Monitor and Audit
• Log all backup activity, including access and restore attempts
• Review permissions regularly
Evidence the Assessor Will Look For
• Backup encryption settings and reports
• Policies defining how backup CUI is protected
• Physical access controls for local backup storage
• Cloud storage configurations showing CUI protection
• Audit logs of access to backup data
Common Gaps
• Backups stored without encryption
• Default or shared admin access to backup platforms
• Portable media left unsecured or unmanaged
• Cloud backups configured without access controls or logging
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Ensuring backup encryption is applied across all media types
• Controlling who can access and restore CUI from backups
• Monitoring backup locations for unauthorized access or misconfiguration
• Supporting secure integration with FedRAMP-moderate equivalent cloud storage
• Providing documentation and evidence of CUI backup protection for assessments
With Cuick Trac, your backups aren’t just available—they’re secure, controlled, and compliant.
Final CTA
Your backups are only as strong as the protections around them.
Schedule a Cuick Trac demo to secure your CUI backups—onsite, offsite, or in the cloud.