How should backups and snapshots containing CUI be handled?

• A. Backups containing CUI should be kept unencrypted to allow faster recovery.
• B. Backups containing CUI should be stored offline only.
• C. Backups/snapshots containing CUI are protected with equivalent safeguards and access controls.
• D. Backups are not required for CUI.

Answer: (C)

Backups and snapshots containing CUI must be protected with safeguards and access controls equivalent to those protecting the live data. The reason is simple: a backup is another copy of the same sensitive information, so if it isn’t secured to the same standard, it becomes a weak point that could be exploited to access CUI during a breach, theft, or misplacement. Therefore, apply the same level of protection across the board—encryption at rest and in transit where feasible, strict access controls based on least privilege, strong authentication and auditing, and proper handling and disposal of backup media. If a backup environment or vendor is involved, that environment must meet the same CUI protection requirements as the primary system, and backups should be included in the overall security posture, incident response, and risk management processes. This approach ensures continuity without sacrificing security, and it avoids leaving copies of CUI unprotected, which would undermine the safeguards applied to the primary data.