[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fcp-9":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","cp-9","CP-9","System Backup",70,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must back up user-level information, system-level information and system documentation, including security and privacy documentation, at defined frequencies consistent with recovery objectives, and protect the confidentiality, integrity and availability of the backups.\n\n**In practice.** Doing this well means backups that match agreed recovery point objectives, at least one copy that is immutable or offline, encryption of backup data and separate credentials for backup administration. Regular restore tests prove the backups work. Auditors expect backup policies, job success reports, restore test records and evidence of protection against tampering. CIS Control 11 describes the same expectations.\n\n**Common gaps.** The most damaging gap is backups reachable with the same administrator credentials attackers steal, so ransomware destroys them too. Restore testing is often limited to single files rather than full systems.","a. Conduct backups of user-level information contained in [Assignment: organization-defined system components] [Assignment: organization-defined frequency];\n  b. Conduct backups of system-level information contained in the system [Assignment: organization-defined frequency];\n  c. Conduct backups of system documentation, including security- and privacy-related documentation [Assignment: organization-defined frequency] ; and\n  d. Protect the confidentiality, integrity, and availability of backup information.\nDiscussion: System-level information includes system state information, operating system software, middleware, application software, and licenses. User-level information includes information other than system-level information. Mechanisms employed to protect the integrity of system backups include digital signatures and cryptographic hashes. Protection of system backup information while in transit is addressed by [MP-5](#mp-5) and [SC-8](#sc-8) . System backups reflect the requirements in contingency plans as well as other organizational requirements for backing up information. Organizations may be subject to laws, executive orders, directives, regulations, or policies with requirements regarding specific categories of information (e.g., personal health information). Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"connectwise-cloud-backup-suspended-after-microsoft-365-tenant-compromise","ConnectWise Cloud Backup Suspended After Microsoft 365 Tenant Compromise","2026-10-18T10:20:20.475+00:00",{"slug":25,"title":26,"published_at":27},"drone-strikes-on-yandex-data-centers-highlight-physical-resilience-gaps","Drone Strikes on Yandex Data Centers Highlight Physical Resilience Gaps","2026-10-12T20:20:18.165+00:00",{"slug":29,"title":30,"published_at":31},"ahold-delhaize-hit-by-repeat-cyberattack-systems-taken-offline","Ahold Delhaize Hit by Repeat Cyberattack, Systems Taken Offline","2026-10-12T14:20:19.363+00:00",{"slug":33,"title":34,"published_at":35},"ransomware-encrypts-36-pb-of-cloud-data-across-495-japanese-government-and-corporate-clients","Ransomware Encrypts 3.6 PB of Cloud Data Across 495 Japanese Government and Corporate Clients","2026-10-08T22:21:40.501+00:00",{"slug":37,"title":38,"published_at":39},"ransomware-groups-now-target-backups-first-recovery-is-no-longer-guaranteed","Ransomware Groups Now Target Backups First — Recovery Is No Longer Guaranteed","2026-10-07T16:21:31.344+00:00",{"slug":41,"title":42,"published_at":43},"advantest-ransomware-attack-exposes-pii-including-ssns-and-financial-data","Advantest Ransomware Attack Exposes PII Including SSNs and Financial Data","2026-10-07T12:21:12.164+00:00",{"slug":45,"title":46,"published_at":47},"self-healing-wordpress-backdoor-defeats-standard-cleanup-methods","Self-Healing WordPress Backdoor Defeats Standard Cleanup Methods","2026-10-01T16:20:54.623+00:00",{"slug":49,"title":50,"published_at":51},"warlock-ransomware-targets-large-iberian-organizations-via-apt-linked-threat-actor","Warlock Ransomware Targets Large Iberian Organizations via APT-Linked Threat Actor","2026-10-01T14:20:52.331+00:00",{"slug":53,"title":54,"published_at":55},"self-healing-wordpress-malware-defeats-traditional-cleanup-methods","Self-Healing WordPress Malware Defeats Traditional Cleanup Methods","2026-10-01T04:20:20.317+00:00",{"slug":57,"title":58,"published_at":59},"ransomware-hits-south-africas-air-traffic-control-systems","Ransomware Hits South Africa's Air Traffic Control Systems","2026-09-30T08:20:50.35+00:00",{"slug":61,"title":62,"published_at":63},"ai-powered-threat-actor-destroys-azure-resources-via-exposed-credentials","AI-Powered Threat Actor Destroys Azure Resources via Exposed Credentials","2026-09-28T18:21:21.808+00:00",{"slug":65,"title":66,"published_at":67},"ai-powered-ransomware-automates-azure-tenant-destruction","AI-Powered Ransomware Automates Azure Tenant Destruction","2026-09-28T18:20:53.034+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",42,{"slug":75,"name":76,"problem":77,"stories":78},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",36,{"slug":80,"name":81,"problem":82,"stories":83},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",20,{"slug":85,"name":86,"problem":87,"stories":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",11,{"slug":90,"name":91,"problem":92,"stories":93},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",9,{"slug":95,"name":96,"problem":97,"stories":98},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",8,[100,106,111,116,122,127,132,137],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","11","Control 11","Data Recovery",58,{"family":107,"item":108,"code":109,"title":109,"together":110},"itil","overview","ITIL",41,{"family":5,"item":112,"code":113,"title":114,"together":115},"ir-4","IR-4","Incident Handling",40,{"family":117,"item":118,"code":119,"title":120,"together":121},"gdpr","32","Article 32","Security of processing",35,{"family":101,"item":123,"code":124,"title":125,"together":126},"12","Control 12","Network Infrastructure Management",19,{"family":101,"item":128,"code":129,"title":130,"together":131},"13","Control 13","Network Monitoring and Defense",18,{"family":117,"item":133,"code":134,"title":135,"together":136},"33","Article 33","Notification of a personal data breach to the supervisory authority",15,{"family":101,"item":138,"code":139,"title":140,"together":141},"17","Control 17","Incident Response Management",14]