CP-9(6)

Requirement

Conduct system backup by maintaining a redundant secondary system that is not collocated with the primary system and that can be activated without loss of information or disruption to operations.

Discussion

The effect of system backup can be achieved by maintaining a redundant secondary system that mirrors the primary system, including the replication of information. If this type of redundancy is in place and there is sufficient geographic separation between the two systems, the secondary system can also serve as the alternate processing site.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Contingency planning policy; procedures addressing system backup; contingency plan; system backup test results; contingency plan test results; contingency plan test documentation; redundant secondary system for system backups; location(s) of redundant secondary backup system(s); system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system backup responsibilities; organizational personnel with information security responsibilities; organizational personnel with responsibility for the redundant secondary system].

Test

[SELECT FROM: Organizational processes for maintaining redundant secondary systems; mechanisms supporting and/or implementing system backups; mechanisms supporting and/or implementing information transfer to a redundant secondary system].

ID	Assessment Objectives
CP-09(06)[01]	system backup is conducted by maintaining a redundant secondary system that is not collocated with the primary system;
CP-09(06)[02]	system backup is conducted by maintaining a redundant secondary system that can be activated without loss of information or disruption to operations.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!