CCI-000537

The organization conducts backups of system-level information contained in the information system per organization-defined frequency that is consistent with recovery time and recovery point objectives.

Implementation Guidance

The organization being inspected/assessed must identify system-level information within the backup strategy and configure the system to perform backups at least weekly and as required by system baseline configuration changes in accordance with the contingency plan.

Validation Procedures

The organization conducting the inspection/assessment obtains and reviews the backup strategy, and examines a sample of systems to ensure they are configured to perform back ups at least weekly and as required by system baseline configuration changes in accordance with the contingency plan.

Compelling Evidence

1.) Signed and dated contingency plan, referencing frequency of backup sections 2.) Sample or audit of backup

The controls below (if any) were marked by NIST as being related to CCI-000537.