Skip to main content
CMDashCybersecurity Maturity Dashboard
Contingency Planning

CP-9 System backup

FedRAMP Moderate · Rev 5

What the standard requires

a. Conduct backups of user-level information contained in [system components] [frequency]; b. Conduct backups of system-level information contained in the system [frequency]; c. Conduct backups of system documentation, including security- and privacy-related documentation [frequency] ; and d. Protect the confidentiality, integrity, and availability of backup information.

Quoted verbatim from NIST SP 800-53 Rev 5 (OSCAL catalog), which is in the public domain.

Maps to 3 controls in 3 other frameworks

FrameworkControl
HITRUST CSF v1109.f.01 Back-ups of information and software are taken and tested regularly
NIST Cybersecurity Framework (1.1, legacy)PR.IP-4 Backups conducted and tested
TISAX (VDA ISA v6)5.5.1 Backup procedures protect critical information

Mappings are CMDash’s own, seeded with the product and shown on both frameworks they connect. In the product they mean evidence you attach here also counts against the controls listed above.

Track CP-9 with evidence behind it

In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.

Start free trialAll FedRAMP Moderate controls
CP-9 System backup — FedRAMP Moderate | CMDash