Alternate Storage Site CP-6
Contingency Planning · Moderate baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds CP-6 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Contingency Planning family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
CP-6 (Alternate Storage Site) means keeping a copy of this server’s backups somewhere other than the room the server lives in — so a fire, flood, theft, or ransomware that hits the primary site does not take the backups with it. That off-site copy must be protected as well as the original. It is a Moderate-baseline control, so it applies as the system moves up from Low.
What good looks like
- Keep at least one backup copy off-site — a different building, a second location, or object storage in another region.
- Put the necessary agreements in place so you can actually store to and retrieve from that site when you need it.
- Give the off-site copy controls equal to the primary — encryption, access limits, and monitoring, not a looser standard.
- Follow the 3-2-1 rule — three copies, on two kinds of media, with one off-site — and keep one copy offline or immutable (unable to be changed or deleted) so ransomware cannot reach it.
- Confirm you can retrieve from the off-site copy, not just write to it.
Framework mapping
- NIST CSF 2.0 — PR.DS-11 — Backups of data are created, protected, maintained, and tested
- CIS Controls v8 — Control 11 — Data Recovery
How to move it toward Implemented
- Add an off-site target to the backup job — for example push encrypted backups to remote object storage or a second host (
restic -r s3:..., orrsyncover SSH (Secure Shell) to an off-site box). - Encrypt the off-site copy and lock down access (a dedicated key, least-privilege credentials); if the store supports it, turn on object lock or immutability so a copy cannot be deleted or overwritten.
- Do a test retrieval from the off-site copy into a scratch path and confirm it restores — storing is only half the control.
- Attach the off-site backup configuration and retrieval-test result as hardening evidence on the asset, naming
CP-6in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.