MP.L2-3.8.9
Protect Backups
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee MP.L2-3.8.9 in the reference catalog with its NIST cross-references
Official requirement
Protect the confidentiality of backup CUI at storage locations.
Assessment objectives
a. the confidentiality of backup CUI is protected at storage locations.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Protect the confidentiality of backup copies of controlled information at their storage locations.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are in charge of protecting CUI for your company. Because the company’s backups contain CUI, you work with IT to protect the confidentiality of backup data. You agree to encrypt all CUI data as it is saved to an external hard drive [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Procedures addressing system backup; system configuration settings and associated documentation; security plan; backup storage locations; system backup logs or records; other relevant documents or records
Common mistakes
Encrypting production storage while leaving backup copies or backup media exposed.