ComplianceNIST 800-53 control

NIST-CP-9 System Backup

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
CP Contingency Planning
Control
CP-9
ATT&CK techniques mitigated
22

Control statement

a. Conduct backups of user-level information contained in [Assignment: system components] [Assignment: frequency]; b. Conduct backups of system-level information contained in the system [Assignment: frequency]; c. Conduct backups of system documentation, including security- and privacy-related documentation [Assignment: frequency] ; and d. Protect the confidentiality, integrity, and availability of backup information.

Discussion

System-level information includes system state information, operating system software, middleware, application software, and licenses. User-level information includes information other than system-level information. Mechanisms employed to protect the integrity of system backups include digital signatures and cryptographic hashes. Protection of system backup information while in transit is addressed by [MP-5](#mp-5) and [SC-8](#sc-8) . System backups reflect the requirements in contingency plans as well as other organizational requirements for backing up information. Organizations may be subject to laws, executive orders, directives, regulations, or policies with requirements regarding specific categories of information (e.g., personal health information). Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.

ATT&CK mappings (CTID)

• T1003 OS Credential Dumping • T1003.003 NTDS • T1005 Data from Local System • T1025 Data from Removable Media • T1070 Indicator Removal • T1070.001 Clear Windows Event Logs • T1070.002 Clear Linux or Mac System Logs • T1070.008 Clear Mailbox Data • T1119 Automated Collection • T1485 Data Destruction • T1485.001 Lifecycle-Triggered Deletion • T1486 Data Encrypted for Impact • T1490 Inhibit System Recovery • T1491 Defacement • T1491.001 Internal Defacement • T1491.002 External Defacement • T1561 Disk Wipe • T1561.001 Disk Content Wipe • T1561.002 Disk Structure Wipe • T1565 Data Manipulation • T1565.001 Stored Data Manipulation • T1565.003 Runtime Data Manipulation

Related

Mitigates · not in database (2)

Mitigates · MITRE ATT&CK (20)

  • T1485.001 Lifecycle-Triggered Deletion sub-technique
  • T1070.008 Clear Mailbox Data sub-technique
  • T1565 Data Manipulation technique
  • T1565.001 Stored Data Manipulation sub-technique
  • T1565.003 Runtime Data Manipulation sub-technique
  • T1491.001 Internal Defacement sub-technique
  • T1491.002 External Defacement sub-technique
  • T1561 Disk Wipe technique
  • T1561.001 Disk Content Wipe sub-technique
  • T1561.002 Disk Structure Wipe sub-technique
  • T1003.003 NTDS sub-technique
  • T1491 Defacement technique
  • T1490 Inhibit System Recovery technique
  • T1486 Data Encrypted for Impact technique
  • T1485 Data Destruction technique
  • T1003 OS Credential Dumping technique
  • T1005 Data from Local System technique
  • T1025 Data from Removable Media technique
  • T1070 Indicator Removal technique
  • T1119 Automated Collection technique

Related control · Compliance (10)

  • NIST-CP-10 System Recovery and Reconstitution NIST 800-53 control
  • NIST-CP-2 Contingency Plan NIST 800-53 control
  • NIST-CP-6 Alternate Storage Site NIST 800-53 control
  • NIST-MP-4 Media Storage NIST 800-53 control
  • NIST-MP-5 Media Transport NIST 800-53 control
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-13 Cryptographic Protection NIST 800-53 control
  • NIST-SC-8 Transmission Confidentiality and Integrity NIST 800-53 control
  • NIST-SI-13 Predictable Failure Prevention NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

Referenced by Compliance · enhancement of (7)

  • NIST-CP-9(1) Testing for Reliability and Integrity NIST 800-53 enhancement
  • NIST-CP-9(2) Test Restoration Using Sampling NIST 800-53 enhancement
  • NIST-CP-9(3) Separate Storage for Critical Information NIST 800-53 enhancement
  • NIST-CP-9(5) Transfer to Alternate Storage Site NIST 800-53 enhancement
  • NIST-CP-9(6) Redundant Secondary System NIST 800-53 enhancement
  • NIST-CP-9(7) Dual Authorization for Deletion or Destruction NIST 800-53 enhancement
  • NIST-CP-9(8) Cryptographic Protection NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-CP Contingency Planning NIST 800-53 family

Referenced by Compliance · related control (19)

  • NIST-AC-3(2) Dual Authorization NIST 800-53 enhancement
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-CP-10 System Recovery and Reconstitution NIST 800-53 control
  • NIST-CP-2 Contingency Plan NIST 800-53 control
  • NIST-CP-4 Contingency Plan Testing NIST 800-53 control
  • NIST-CP-6 Alternate Storage Site NIST 800-53 control
  • NIST-CP-7 Alternate Processing Site NIST 800-53 control
  • NIST-MP-2 Media Access NIST 800-53 control
  • NIST-MP-3 Media Marking NIST 800-53 control
  • NIST-MP-4 Media Storage NIST 800-53 control
  • NIST-MP-5 Media Transport NIST 800-53 control
  • NIST-SA-24 Design For Cyber Resiliency NIST 800-53 control
  • NIST-SC-13 Cryptographic Protection NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-36(2) Synchronization NIST 800-53 enhancement
  • NIST-SI-13(5) Failover Capability NIST 800-53 enhancement