Navigate

CCI-004023

CCI-004023 Definition

Protect integrity of backup information.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - the confidentiality of backup information is protected. - the integrity of backup information is protected. - the availability of backup information is protected.

Validation Procedures

Examine: [SELECT FROM: Contingency planning policy; procedures addressing system backup; contingency plan; backup storage location(s); system backup logs or records; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system backup responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes for conducting system backups; mechanisms supporting and/or implementing system backups].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004023.

Control	Description
CP-9	a: Conduct backups of user-level information contained in [system components for which to conduct backups of user-level information is defined;] [frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives is defined;]; b: Conduct backups of system-level information contained in the system [frequency at which to conduct backups of system-level information consistent with recovery time and recovery point objectives is defined;]; c: Conduct backups of system documentation, including security- and privacy-related documentation [frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives is defined;] ; and d: Protect the confidentiality, integrity, and availability of backup information.

Control

Description

CP-9

a: Conduct backups of user-level information contained in [system components for which to conduct backups of user-level information is defined;] [frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives is defined;];

b: Conduct backups of system-level information contained in the system [frequency at which to conduct backups of system-level information consistent with recovery time and recovery point objectives is defined;];

c: Conduct backups of system documentation, including security- and privacy-related documentation [frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives is defined;] ; and

d: Protect the confidentiality, integrity, and availability of backup information.