CP-9(1)

Requirement

Test backup information [Assignment: organization-defined frequency] to verify media reliability and information integrity.

Discussion

Organizations need assurance that backup information can be reliably retrieved. Reliability pertains to the systems and system components where the backup information is stored, the operations used to retrieve the information, and the integrity of the information being retrieved. Independent and specialized tests can be used for each of the aspects of reliability. For example, decrypting and transporting (or transmitting) a random sample of backup files from the alternate storage or backup site and comparing the information to the same information at the primary processing site can provide such assurance.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Contingency planning policy; procedures addressing system backup; contingency plan; system backup test results; contingency plan test documentation; contingency plan test results; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system backup responsibilities; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Organizational processes for conducting system backups; mechanisms supporting and/or implementing system backups].

ID	Assessment Objectives
CP-09(01)[01]	backup information is tested <CP-09(01)_ODP[01] frequency> to verify media reliability;
CP-09(01)[02]	backup information is tested <CP-09(01)_ODP[02] frequency> to verify information integrity.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!