Backup and Disaster Recovery for CMMC Compliance

Protecting Controlled Unclassified Information means more than preventing unauthorized access. You must also ensure CUI remains available when systems fail, data is corrupted, or disasters strike. CMMC requires backup and recovery capabilities that allow you to restore operations and data after incidents.

CUI stands for Controlled Unclassified Information—sensitive government data requiring protection but not classified as secret.

This guide covers backup and disaster recovery requirements for CMMC compliance and helps you implement solutions that protect your data while meeting certification standards.

CMMC Requirements for Backup and Recovery

Several CMMC Level 2 requirements relate to backup and disaster recovery:

CP.L2-3.8.9: Protect Backup CUI

“Protect the confidentiality of backup CUI at storage locations.”

Backups containing CUI must receive the same protection as primary data. This means:

• Encrypting backup data at rest
• Controlling access to backup storage
• Securing backup media physically
• Protecting off-site backup locations

MP.L2-3.8.3: Media Sanitization

When disposing of backup media, you must sanitize it properly to prevent CUI exposure. Old backup tapes and drives cannot simply be discarded.

MP.L2-3.8.6: Portable Storage Encryption

Backup media transported outside your facility must be encrypted using FIPS-validated cryptography.

FIPS stands for Federal Information Processing Standard—government standards for cryptography and security.

IR.L2-3.6.1: Incident Handling

Recovery capabilities are essential for incident response. When ransomware encrypts your files or attackers corrupt your data, backups enable recovery.

SC.L2-3.13.11: CUI Encryption

If backups are stored on systems accessible via a network, CUI in those backups must be encrypted.

Backup Fundamentals for CMMC

What to Back Up

Ensure backups cover all CUI and systems processing CUI:

• File servers containing CUI documents
• Email systems with CUI messages
• Databases with CUI data
• Application configurations
• User workstation data (if CUI is stored locally)
• System configurations for CUI systems

Backup Types

Full Backup: Complete copy of all data. Takes the longest but simplest to restore.

Incremental Backup: Only data changed since the last backup. Faster backup, but restoration requires all incremental backups plus last full backup.

Differential Backup: All data changed since the last full backup. Balance between backup time and restoration simplicity.

The 3-2-1 Rule

A widely accepted backup strategy:

• 3 copies of your data (production plus two backups)
• 2 different storage types (local disk plus tape, or local plus cloud)
• 1 copy off-site (protected from local disasters)

This approach protects against hardware failure, ransomware, and physical disasters.

Encrypting Backups for CMMC

All backups containing CUI must be encrypted. This is non-negotiable for CMMC compliance.

Encryption at Rest

Encrypt backup data wherever it is stored:

• Enable encryption in backup software
• Use encrypted storage targets
• Verify encryption is active, not just available

Encryption in Transit

Encrypt data while transferring to backup locations:

• Use encrypted connections to cloud backup
• Enable encryption for network backup traffic
• Protect data during off-site transport

Key Management

Protect encryption keys carefully:

• Store keys separately from encrypted backups
• Document key recovery procedures
• Test that you can decrypt backups with stored keys
• Consider key escrow for critical backups

FIPS-Validated Encryption

Use FIPS 140-2 validated encryption modules for CUI backups. Most enterprise backup solutions offer FIPS-compliant encryption options.

Backup Solutions for Defense Contractors

Cloud Backup Services

Cloud backup provides off-site storage with minimal infrastructure:

Microsoft Azure Backup (GCC/GCC High):

• Integrates with Microsoft 365 government clouds
• Meets FedRAMP requirements
• Encrypts data in transit and at rest
• Suitable for Microsoft-centric environments

AWS Backup (GovCloud):

• Amazon’s government cloud backup service
• FedRAMP High authorized
• Supports various data sources
• Good for AWS-based infrastructure

Commvault (Government offerings):

• Enterprise backup with government options
• Comprehensive data protection
• On-premises and cloud flexibility
• Strong encryption capabilities

Veeam:

• Popular backup platform
• Government and compliance-focused features
• Supports cloud and on-premises
• Good for virtualized environments

On-Premises Backup

Some contractors prefer keeping backups on-site or within their control:

Pros:

• Direct control over backup infrastructure
• No concerns about cloud compliance
• May satisfy specific contract requirements

Cons:

• Requires investment in hardware
• Off-site protection needs separate solution
• Maintenance and management burden

Solutions:

• Veeam Backup & Replication
• Commvault
• Veritas NetBackup
• Acronis Cyber Protect

Hybrid Approaches

Combine on-premises and cloud for comprehensive protection:

• Primary backups stored locally for fast recovery
• Secondary copies replicated to compliant cloud
• Best of both approaches
• Meets 3-2-1 rule naturally

Disaster Recovery Planning

Backup is only part of the equation. You need plans to actually recover operations when disaster strikes.

Recovery Time Objective (RTO)

How quickly must you restore operations? Different systems may have different RTOs:

• Critical systems: Hours
• Important systems: 24 hours
• Non-critical systems: Days

RTO stands for Recovery Time Objective—the maximum acceptable time to restore a system after a failure or disaster.

Recovery Point Objective (RPO)

How much data loss is acceptable? This determines backup frequency:

• RPO of 1 hour: Back up at least hourly
• RPO of 24 hours: Daily backups sufficient
• RPO of zero: Continuous replication needed

RPO stands for Recovery Point Objective—the maximum acceptable amount of data loss measured in time.

Disaster Recovery Plan Components

Document your recovery procedures:

1. Roles and responsibilities – Who does what during recovery
2. Contact information – Emergency contacts, vendors, stakeholders
3. System priorities – Which systems to recover first
4. Recovery procedures – Step-by-step restoration instructions
5. Communication plan – How to notify stakeholders
6. Alternative operations – How to work while systems are down

Testing Your Recovery

Untested recovery plans often fail when needed:

• Test backup restoration regularly
• Conduct disaster recovery exercises annually
• Document test results
• Update plans based on lessons learned

Protecting Backup Media

Physical backup media requires protection:

Storage Security

• Store backup media in locked areas
• Limit access to authorized personnel
• Use fireproof and waterproof storage for critical media
• Maintain access logs for media storage areas

Off-Site Storage

• Use secure facilities for off-site backup storage
• Verify facility security meets your requirements
• Encrypt all media before transport
• Track chain of custody during transport

Media Handling

• Label backup media clearly (without revealing contents externally)
• Track media inventory
• Rotate media according to retention schedules
• Sanitize media before disposal or reuse

Common Backup Mistakes for CMMC

Mistake 1: Unencrypted Backups

Backups containing CUI must be encrypted. Unencrypted backups are a compliance failure and security risk.

Mistake 2: Never Testing Recovery

If you have never restored from backup, you do not know if recovery actually works. Test regularly.

Mistake 3: Backups on the Same Network

Ransomware often targets backups. If backups are on the same network without protection, they get encrypted too. Isolate or protect backup infrastructure.

Mistake 4: No Off-Site Copy

Local-only backups do not protect against fires, floods, or facility-wide incidents. Maintain off-site copies.

Mistake 5: Ignoring Backup Media Disposal

Old backup tapes and drives contain CUI. Sanitize or destroy them properly rather than discarding.

Mistake 6: Unclear Recovery Procedures

During a crisis, you need clear documented procedures. Winging it leads to mistakes and extended downtime.

Documenting for CMMC Assessment

Prepare backup-related evidence for assessors:

Policies and Procedures

• Backup policy defining requirements
• Backup procedures specifying schedules and methods
• Disaster recovery plan
• Media handling procedures

Technical Evidence

• Backup configuration documentation
• Encryption configuration verification
• Sample backup logs
• Recovery test results

Operational Evidence

• Backup monitoring records
• Recovery test reports
• Media inventory and tracking records
• Off-site storage agreements or procedures

Key Takeaways

CMMC requires backup and recovery capabilities that protect CUI availability while maintaining confidentiality. All backups containing CUI must be encrypted using FIPS-validated cryptography.

Follow the 3-2-1 rule: three copies, two media types, one off-site. Test your recovery procedures regularly—untested backups provide false confidence.

Document your backup and disaster recovery processes for CMMC assessors, including policies, procedures, configuration, and test results.

Backup is not optional for CMMC compliance. It is essential for both meeting requirements and actually protecting your operations.

Related Articles:

• What is CMMC Level 2?
• CMMC Media Protection Requirements
• Essential Tools for CMMC Compliance
• NIST SP 800-171 Rev 2
• 32 CFR Part 170 – CMMC Program Rule

Official Sources: This article is based on NIST SP 800-171 Revision 2 and 32 CFR Part 170. Solution recommendations should be evaluated for your specific environment and contract requirements.

Need help implementing backup and disaster recovery for CMMC compliance? Contact Greypike for expert guidance on Level 1 and Level 2 certification, or get started with Obolix to streamline your compliance journey.