Backup Policy
Defines how Your Organization backs up critical data and systems — the 3-2-1 rule, immutability, restore testing, and retention — so a backup is provably recoverable, not just present.
Maps to FedRAMP Moderate CP-9 · CMMC Level 2 MP.L2-3.8.9 · SOC 2 Type II A1.3 · NIST Cybersecurity Framework 2.0 RC.RP-03
Read it now — the PDF opens either way.
Purpose
A backup that has never been restored is a hypothesis, not a recovery capability. This policy defines how Your Organization backs up critical data and systems, and — because the existence of a backup proves nothing on its own — how backup integrity and restorability are actually verified.
Scope
This policy applies to every system and data store holding Your Organization production data or Controlled Unclassified Information (CUI), and to the engineering and platform teams responsible for configuring, monitoring, and restoring backups.
7 more sections in the full template
The 3-2-1 rule · Backup frequency · Immutability · Access and encryption · Restore testing · Retention · Review cadence. Download the full document above, or open it in CMDash to fill in your organization name and effective date automatically.
Use this policy for real, not just on paper
“Open in CMDash” pre-selects the Backup Policy template the first time you create a policy — your organization name and today’s date fill in automatically, and it lands as a DRAFT you can edit before publishing.