How should backups containing CUI be safeguarded?

• A. Backups containing CUI may be stored without encryption if access is restricted.
• B. Backups containing CUI must be safeguarded with the same level of protection (encryption and access controls) as the primary data.
• C. Backups do not require encryption but should be physically secured.
• D. Backups containing CUI may be copied to personal devices for convenience.

Answer: (B)

Safeguarding backups containing CUI requires protecting them at the same level as the primary data. This means encrypting backups both at rest and in transit and enforcing strict access controls so only authorized personnel can view or restore the data. Keeping that consistent protection minimizes the risk of exposure if a backup is lost, stolen, or mishandled and helps ensure ongoing compliance with CUI safeguarding requirements. In practice, you’d also implement proper key management, monitoring, and auditing of backup access, plus secure storage locations.

Storing backups without encryption, even with restricted access, leaves them vulnerable to interception or loss. Relying on physical security alone misses risks from digital threats and improper handling. Copying CUI backups to personal devices bypasses organizational controls and is not allowed.