CP-9 System Backup

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	7 (5 in a baseline)

Related controls: CP-2, CP-6, CP-10, MP-4, MP-5, SC-8, SC-12, SC-13, SI-4, SI-13

Control statement

a. Conduct backups of user-level information contained in [Assignment: organization-defined system components] [Assignment: organization-defined frequency];
b. Conduct backups of system-level information contained in the system [Assignment: organization-defined frequency];
c. Conduct backups of system documentation, including security- and privacy-related documentation [Assignment: organization-defined frequency] ; and
d. Protect the confidentiality, integrity, and availability of backup information.

NIST discussion

System-level information includes system state information, operating system software, middleware, application software, and licenses. User-level information includes information other than system-level information. Mechanisms employed to protect the integrity of system backups include digital signatures and cryptographic hashes. Protection of system backup information while in transit is addressed by MP-5 and SC-8 . System backups reflect the requirements in contingency plans as well as other organizational requirements for backing up information. Organizations may be subject to laws, executive orders, directives, regulations, or policies with requirements regarding specific categories of information (e.g., personal health information). Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.

Control enhancements

CP-9(1) Testing for Reliability and Integrity

Baselines: Moderate, High

Test backup information [Assignment: organization-defined frequency] to verify media reliability and information integrity.

Discussion and assessment objectives for CP-9(1)

Organizations need assurance that backup information can be reliably retrieved. Reliability pertains to the systems and system components where the backup information is stored, the operations used to retrieve the information, and the integrity of the information being retrieved. Independent and specialized tests can be used for each of the aspects of reliability. For example, decrypting and transporting (or transmitting) a random sample of backup files from the alternate storage or backup site and comparing the information to the same information at the primary processing site can provide such assurance.

Determine if:

CP-09(01)[01] backup information is tested [Assignment: organization-defined frequency] to verify media reliability;
CP-09(01)[02] backup information is tested [Assignment: organization-defined frequency] to verify information integrity.

Examine: Contingency planning policy; procedures addressing system backup; contingency plan; system backup test results; contingency plan test documentation; contingency plan test results; system security plan; other relevant documents or records.

Interview: Organizational personnel with system backup responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for conducting system backups; mechanisms supporting and/or implementing system backups.

CP-9(2) Test Restoration Using Sampling

Baselines: High

Use a sample of backup information in the restoration of selected system functions as part of contingency plan testing.

Discussion and assessment objectives for CP-9(2)

Organizations need assurance that system functions can be restored correctly and can support established organizational missions. To ensure that the selected system functions are thoroughly exercised during contingency plan testing, a sample of backup information is retrieved to determine whether the functions are operating as intended. Organizations can determine the sample size for the functions and backup information based on the level of assurance needed.

Determine if a sample of backup information in the restoration of selected system functions is used as part of contingency plan testing.

Interview: Organizational personnel with system backup responsibilities; organizational personnel with contingency planning/contingency plan testing responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for conducting system backups; mechanisms supporting and/or implementing system backups.

CP-9(3) Separate Storage for Critical Information

Baselines: High

Store backup copies of [Assignment: organization-defined critical system software and other security-related information] in a separate facility or in a fire rated container that is not collocated with the operational system.

Discussion and assessment objectives for CP-9(3)

Separate storage for critical information applies to all critical information regardless of the type of backup storage media. Critical system software includes operating systems, middleware, cryptographic key management systems, and intrusion detection systems. Security-related information includes inventories of system hardware, software, and firmware components. Alternate storage sites, including geographically distributed architectures, serve as separate storage facilities for organizations. Organizations may provide separate storage by implementing automated backup processes at alternative storage sites (e.g., data centers). The General Services Administration (GSA) establishes standards and specifications for security and fire rated containers.

Determine if backup copies of [Assignment: organization-defined critical system software and other security-related information] are stored in a separate facility or in a fire rated container that is not collocated with the operational system.

Examine: Contingency planning policy; procedures addressing system backup; contingency plan; backup storage location(s); system backup configurations and associated documentation; system backup logs or records; system security plan; other relevant documents or records.

Interview: Organizational personnel with contingency planning and plan implementation responsibilities; organizational personnel with system backup responsibilities; organizational personnel with information security responsibilities.

CP-9(5) Transfer to Alternate Storage Site

Baselines: High

Transfer system backup information to the alternate storage site [Assignment: organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives].

Discussion and assessment objectives for CP-9(5)

System backup information can be transferred to alternate storage sites either electronically or by the physical shipment of storage media.

Determine if:

CP-09(05)[01] system backup information is transferred to the alternate storage site for [Assignment: organization-defined time period];
CP-09(05)[02] system backup information is transferred to the alternate storage site [Assignment: organization-defined transfer rate].

Examine: Contingency planning policy; procedures addressing system backup; contingency plan; system backup logs or records; evidence of system backup information transferred to alternate storage site; alternate storage site agreements; system security plan; other relevant documents or records.

Interview: Organizational personnel with system backup responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for transferring system backups to the alternate storage site; mechanisms supporting and/or implementing system backups; mechanisms supporting and/or implementing information transfer to the alternate storage site.

CP-9(6) Redundant Secondary System

Baselines: Not in a baseline

Conduct system backup by maintaining a redundant secondary system that is not collocated with the primary system and that can be activated without loss of information or disruption to operations.

Discussion and assessment objectives for CP-9(6)

The effect of system backup can be achieved by maintaining a redundant secondary system that mirrors the primary system, including the replication of information. If this type of redundancy is in place and there is sufficient geographic separation between the two systems, the secondary system can also serve as the alternate processing site.

Determine if:

CP-09(06)[01] system backup is conducted by maintaining a redundant secondary system that is not collocated with the primary system;
CP-09(06)[02] system backup is conducted by maintaining a redundant secondary system that can be activated without loss of information or disruption to operations.

Examine: Contingency planning policy; procedures addressing system backup; contingency plan; system backup test results; contingency plan test results; contingency plan test documentation; redundant secondary system for system backups; location(s) of redundant secondary backup system(s); system security plan; other relevant documents or records.

Interview: Organizational personnel with system backup responsibilities; organizational personnel with information security responsibilities; organizational personnel with responsibility for the redundant secondary system.

Test: Organizational processes for maintaining redundant secondary systems; mechanisms supporting and/or implementing system backups; mechanisms supporting and/or implementing information transfer to a redundant secondary system.

CP-9(7) Dual Authorization for Deletion or Destruction

Baselines: Not in a baseline

Enforce dual authorization for the deletion or destruction of [Assignment: organization-defined backup information].

Discussion and assessment objectives for CP-9(7)

Dual authorization ensures that deletion or destruction of backup information cannot occur unless two qualified individuals carry out the task. Individuals deleting or destroying backup information possess the skills or expertise to determine if the proposed deletion or destruction of information reflects organizational policies and procedures. Dual authorization may also be known as two-person control. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals.

Determine if dual authorization for the deletion or destruction of [Assignment: organization-defined backup information] is enforced.

Examine: Contingency planning policy; procedures addressing system backup; contingency plan; system design documentation; system configuration settings and associated documentation; system generated list of dual authorization credentials or rules; logs or records of deletion or destruction of backup information; system security plan; other relevant documents or records.

Interview: Organizational personnel with system backup responsibilities; organizational personnel with information security responsibilities.

Test: Mechanisms supporting and/or implementing dual authorization; mechanisms supporting and/or implementing the deletion/destruction of backup information.

CP-9(8) Cryptographic Protection

Baselines: Moderate, High

Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information].

Discussion and assessment objectives for CP-9(8)

The selection of cryptographic mechanisms is based on the need to protect the confidentiality and integrity of backup information. The strength of mechanisms selected is commensurate with the security category or classification of the information. Cryptographic protection applies to system backup information in storage at both primary and alternate locations. Organizations that implement cryptographic mechanisms to protect information at rest also consider cryptographic key management solutions.

Determine if cryptographic mechanisms are implemented to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information].

Interview: Organizational personnel with system backup responsibilities; organizational personnel with information security responsibilities.

Test: Mechanisms supporting and/or implementing cryptographic protection of backup information.

Withdrawn enhancements: CP-9(4).

Assessment objectives (SP 800-53A)

Objectives and methods for CP-9

Determine if:

CP-09a. backups of user-level information contained in [Assignment: organization-defined system components] are conducted [Assignment: organization-defined frequency];
CP-09b. backups of system-level information contained in the system are conducted [Assignment: organization-defined frequency];
CP-09c. backups of system documentation, including security- and privacy-related documentation are conducted [Assignment: organization-defined frequency];
CP-09d.
- CP-09d.[01] the confidentiality of backup information is protected;
- CP-09d.[02] the integrity of backup information is protected;
- CP-09d.[03] the availability of backup information is protected.

Examine: Contingency planning policy; procedures addressing system backup; contingency plan; backup storage location(s); system backup logs or records; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with system backup responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for conducting system backups; mechanisms supporting and/or implementing system backups.

Policy statement

The System owner shall ensure backups of user-level information in Fill in: system components for which to conduct backups of user-level information Typical: all servers and cloud storage that hold user data are made Fill in: frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives Typical: daily incremental and weekly full, or more often where the recovery point objective requires it. (CP-9a)
The System owner shall ensure backups of system-level information are made Fill in: frequency at which to conduct backups of system-level information consistent with recovery time and recovery point objectives Typical: daily incremental and weekly full, or more often where the recovery point objective requires it. (CP-9b)
The System owner shall ensure backups of system documentation, including security- and privacy-related documentation, are made Fill in: frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives Typical: on each change. (CP-9c)
The System owner shall protect the confidentiality, integrity and availability of backup information. (CP-9d)

CP-9(1) Testing for reliability and integrity

The System owner shall test backup information Fill in: frequency at which to test backup information for media reliability Typical: quarterly to verify media reliability. (CP-9(1))
The System owner shall test backup information Fill in: frequency at which to test backup information for information integrity Typical: quarterly to verify information integrity. (CP-9(1))

CP-9(2) Test restoration using sampling

The System owner shall use a sample of backup information to restore selected system functions as part of contingency plan testing. (CP-9(2))

CP-9(3) Separate storage for critical information

The System owner shall store backup copies of Fill in: critical system software and other security-related information backups to be stored in a separate facility Typical: system software, configuration baselines, and security-related information such as cryptographic key backups in a separate facility, or in a fire-rated container not collocated with the operational system. (CP-9(3))

CP-9(5) Transfer to alternate storage site

The System owner shall transfer system backup information to the alternate storage site Fill in: time period consistent with recovery time and recovery point objectives Typical: daily, at Fill in: transfer rate consistent with recovery time and recovery point objectives Typical: a rate that keeps the alternate copy within the recovery point objective. (CP-9(5))

CP-9(8) Cryptographic protection

The System owner shall implement cryptographic mechanisms to prevent unauthorized disclosure and modification of Fill in: backup information to protect against unauthorized disclosure and modification Typical: all backup information. (CP-9(8))

Federal systems

Federal systems use cryptographic modules validated by the NIST Cryptographic Module Validation Program, as SC-13 requires. The CMVP’s FIPS 140-3 transition page sets the schedule for moving FIPS 140-2 validations to the Historical List in September 2026, and says that modules on the Historical List remain supported for existing systems (as of September 2026).

The System owner shall encrypt backup information with CMVP-validated cryptographic modules. (CP-9(8))

From the Contingency Planning Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

CP-9 requires backups of user data, system data and system documentation, at frequencies that meet the recovery point objectives from the business impact analysis, and protection of those backups. Assessors increasingly ask how backups are protected from ransomware, not only whether they exist.

Common implementations. Automated backups with at least one copy offline, immutable or logically separated from the production environment. Backups encrypted (CP-9(8)) and access limited to backup administrators. Periodic restore tests to prove the backups work (CP-9(1)).

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Components with user-level backups (a)	All servers and cloud storage that hold user data
Backup frequencies (a, b, c)	Set from the recovery point objectives; commonly daily incremental and weekly full backups, and system documentation on each change

Evidence assessors ask for.

Backup schedules and recent job reports
Results of the latest restore test
Configuration showing backup encryption and access restrictions

Inheritance. Enterprise backup services are often common; the system owns defining what is backed up and how often.

Common findings.

Backups never tested by restoring them.
Backup storage reachable with the same administrator credentials as production.
System documentation and configuration not included in backups.

Enhancements in the Moderate baseline. CP-9(1) testing for reliability and integrity and CP-9(8) cryptographic protection. High adds CP-9(2), CP-9(3) and CP-9(5).

Artifacts

Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.