3.8.9: Protect the confidentiality of backup CUI at storage locations

Control Family:

Media Protection

Control Type:


CSF v1.1 References:


Organizations can employ cryptographic mechanisms or alternative physical controls to protect the confidentiality of backup information at designated storage locations. Backed-up information containing CUI may include system-level information and user-level information. System-level information includes system-state information, operating system software, application software, and licenses. User-level information includes information other than system-level information.