BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

CP-09(03) Separate Storage for Critical Information

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
unchanged CP High baseline part of CP-9

Title

Separate Storage for Critical Information

Control

Store backup copies of [Assignment: critical system software and other security-related information] in a separate facility or in a fire rated container that is not collocated with the operational system.

Discussion

Separate storage for critical information applies to all critical information regardless of the type of backup storage media. Critical system software includes operating systems, middleware, cryptographic key management systems, and intrusion detection systems. Security-related information includes inventories of system hardware, software, and firmware components. Alternate storage sites, including geographically distributed architectures, serve as separate storage facilities for organizations. Organizations may provide separate storage by implementing automated backup processes at alternative storage sites (e.g., data centers). The General Services Administration (GSA) establishes standards and specifications for security and fire rated containers.

Parameters

cp-09.03_odp: critical system software and other security-related information

Related controls

cm-2, cm-6, cm-8

Assessment objective

CP-09(03) backup copies of [Assignment: critical system software and other security-related information] are stored in a separate facility or in a fire rated container that is not collocated with the operational system.

STIG rules that implement this control 0

No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).