Which backup practice best ensures continued protection of CUI during storage?

• A. Ensure backups/snapshots containing CUI are protected with equivalent safeguards and access controls.
• B. Backups may be stored on personal devices.
• C. Backups should be left unencrypted for speed.
• D. Backups are not necessary for CUI.

Answer: (A)

Backups containing CUI must be protected with equivalent safeguards and access controls. Treat backup copies as equally sensitive data—encrypt data at rest, enforce strict access controls, require authentication, and monitor and audit access just as you would for the live information. This approach maintains confidentiality and integrity during storage and supports secure recovery. Options that rely on personal devices, leave backups unencrypted, or assume backups aren’t needed introduce risk or undermine protection because they bypass the controls that keep CUI secure in storage and during restoration.