What this requirement asks
Protect the confidentiality of backup CUI at storage locations.
This is a CMMC Level 2 requirement in the Media Protection family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (1)
- 3.8.9[a] — the confidentiality of backup CUI is protected at storage locations
What an assessor examines
Examine:
- Procedures addressing system backup
- system configuration settings and associated documentation
- security plan
- backup storage locations
- system backup logs or records
- other relevant documents or records
Interview:
- Personnel with system backup responsibilities
- personnel with information security responsibilities
Test:
- Organizational processes for conducting system backups
- mechanisms supporting or implementing system backups
Evidence that defends it
Show backup job success logs and restore tests
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.