Protect Backups

Start by listing every place a backup of CUI lands.

The list includes server images, file share snapshots, cloud tenant retention, the network storage box in the closet, the external drive someone rotates, and a line-of-business vendor's own backup. The requirement covers the confidentiality of backup CUI, the controlled unclassified information you protect, at each storage location. The location you forgot is the finding. If CUI is in a system, its backups hold CUI.

Encryption, access control, and physical security are all valid. Use encryption as the default.

The guide accepts cryptographic mechanisms or physical controls at the storage location. Encrypting backup data with a FIPS-validated mechanism, encryption the government has certified, answers the assessor's follow-up question before it is asked. A locked room plus tightly limited access is the alternative for on-premises media you cannot encrypt.

Cloud backup inheritance is real, but only as complete as your backup inventory.

If every backup of CUI lives inside your FedRAMP-authorized cloud environment, one the federal government has assessed and approved, the provider's protections can carry this requirement. The claim collapses the moment CUI is also backed up somewhere you did not account for. The inventory from the first lesson is what makes the inheritance defensible.

Inheritance is documented, not declared.

Get the provider's customer responsibility matrix, the document that splits security duties between the provider and you. Find the rows covering backup storage protection. Cite them in your system security plan, the document that describes how your system meets each requirement, next to what remains yours to do. A bare statement that the cloud handles everything is not evidence and invites the questions it cannot answer.