System Backup CP-9

Contingency Planning · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds CP-9 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Contingency Planning family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

CP-9 (System Backup) requires taking backups of user-level data, system-level information (the operating system and its configuration), and system documentation on a defined schedule, and protecting those backups' confidentiality, integrity, and availability. At the Moderate baseline you also test backups to confirm they are reliable (enhancement CP-9(1)).

What good looks like

Back up user-level and system-level information, plus system documentation, on a defined frequency tied to your recovery goals.
Protect the backups themselves - encrypt them and keep a copy offsite or offline so one failure cannot destroy both the system and its only backup.
Test backups on a schedule to confirm the media is reliable and the data actually restores - this is enhancement CP-9(1), required at Moderate.
Label and inventory each backup so you know what it contains and how old it is.

Framework mapping

NIST CSF 2.0 — PR.DS-11 — Backups of data are created, protected, maintained, and tested
CIS Controls v8 — Control 11 — Data Recovery

How to move it toward Implemented

What exists today is point-in-time, not a backup program: the Proxmox pinkteam-baseline snapshot, the one-off as-built text capture, and the AIDE (Advanced Intrusion Detection Environment) baseline are single captures with no cadence.
Schedule a recurring backup - a cron-driven vzdump/qm snapshot job on the Proxmox host, or restic/borg from inside the guest - and send an encrypted copy offsite or offline.
Run and log an actual restore (recover the data, confirm it comes back intact) to close CP-9(1).
Attach the backup schedule and a dated restore-test log as evidence naming CP-9 in the Requirement field - that moves it from 'partial' toward 'Completed'.