What CP-6 alternate storage site requires and why it is hard to evidence
CP-6 requires you to keep a copy of your system backups at a separate alternate storage site, with agreements that allow those backups to be stored there and retrieved when needed, and with controls at that site equivalent to those at the primary site. If an auditor or a contract asks for CP-6, the question is whether a fire, ransomware event or facility loss at the primary location could still leave you with usable backups. A backup that sits in the same building, the same cloud account or under the same administrator credentials as production is often the only copy lost in a single incident. The control exists to remove that single point of failure. It is selected in the moderate and high baselines of SP 800-53B but not in the privacy baseline, so organizations scoping a privacy-only system will not carry it.
In practice, the requirement is proven mostly with three kinds of evidence: the signed agreements or contracts covering the alternate site, configuration records showing that backups are replicated or shipped there on the defined schedule, and restore records showing that data can be pulled back from that site and brought to a working state. The control's own assessment objects point the same way, asking for the contingency plan, the alternate and primary storage site agreements, and the people who run storage and recovery. Confirm with your assessor which form of agreement they will accept for a cloud or managed provider and whether they expect the agreement to name the specific storage location.
The hard part is usually not finding a second location. It is showing that the alternate site is equivalent to the primary one, and that restores work there. Equivalence means the same access control, encryption, logging, retention and integrity checks apply to the copy, which is easy to drift out of line when a backup tool or bucket is configured separately. Restore testing is where many programs fall short: a successful backup job is not evidence of recoverability. Schedule restores from the alternate site, record the results and time taken, and check the restored data against known good values. Open-source tooling such as Bareos, whose catalog records what was backed up and supports restores from a chosen point in time, or restic, whose check --read-data command reads pack files back to confirm stored data is unmodified, can produce that evidence if the configuration and logs are kept. Confirm the restore procedure and frequency with your own contingency plan owner before the assessment.
Which backups, sites and enhancements CP-6 puts in scope
CP-6 only applies once an organization has decided which backups it must be able to restore and how far away they must live. The cards below cover the scoping choices that determine the evidence an assessor will ask for, starting from the baseline your system was categorized under.
Systems and backup sets in scope
Start from the system categorization and the baseline it selected. CP-6 applies to the backup information the system depends on, so list each backup set (user data, system-level data, configuration and documentation) and confirm which ones feed the recovery objectives. Note which sets are excluded and the reason, because an assessor will test the boundary as well as the included sets. Confirm the scope with the system owner and record it in the contingency plan.
Alternate storage site and provider
Decide where backups are stored away from the primary site and whether a third party operates that location. Where a provider is used, the agreement must cover storing and retrieving backup information, so the contract, service levels and access procedures become part of the evidence. Confirm with the provider that the site offers controls equivalent to the primary site, and ask for their attestation scope rather than assuming it.
Moderate baseline enhancements
CP-6(1) requires the alternate storage site to be separated from the primary site far enough to avoid shared disasters, and CP-6(3) addresses accessibility so that personnel can reach the site when needed. Both are selected in the moderate and high baselines. Document the separation distance rationale, the shared-dependency review (power, network, region) and the access arrangements, since each becomes a distinct artifact for the assessor.
High-only recovery objective enhancement
CP-6(2) asks that the alternate storage site support defined recovery time and recovery point objectives. SP 800-53B selects it in the high baseline only, so a moderate system does not need it. For a high system, tie the objectives to the restore tests in CP-9 and CP-10, and keep timed restore results that show the site can meet them. Confirm the objective values with the system owner, since this document does not supply them.
Related controls that share evidence
CP-6 sits beside CP-9 system backup and CP-10 recovery, which produce the backup and restore records it relies on. MP-4 and MP-5 govern media protection and transport when backups move on removable media, and PE-3 covers physical access at the storage facility. Map these controls together so one restore test or access log serves several assessments, and check that each owner knows what evidence they must produce.
How an assessor tests CP-6 with examine, interview and test
This table maps each assessment method in the SP 800-53A procedure for CP-6 to the evidence an assessor requests and the findings that commonly appear. Read it as a preparation checklist: each row shows what the assessor will look for and where organizations most often fall short before the assessment begins.
| Assessment method | Evidence the assessor requests | Common findings |
|---|---|---|
| Examine: contingency plan and alternate site agreements | Current contingency plan sections covering the alternate storage site, signed agreements for the alternate site and any primary storage site arrangements, and the dates they were last reviewed | Agreements are unsigned, expired or never updated after the backup location changed; the contingency plan names a site with no written agreement |
| Examine: equivalence of controls at the alternate site | Documented comparison of access control, encryption, environmental protection and monitoring at the alternate site against the primary site, with the owner who approved it | Equivalence is asserted but not documented; the alternate site has weaker access logging or encryption than the primary without a recorded decision |
| Interview: personnel with alternate storage site responsibilities | Named roles, their duties for moving and retrieving backups, and evidence they know the agreement terms and escalation contacts | Staff who own the site relationship cannot describe retrieval steps; responsibilities sit with a former employee or an unnamed team |
| Interview: personnel with system recovery responsibilities | Recovery roles, the recovery objectives those staff work toward, and how they would request backup media or data from the alternate site | Recovery staff are unaware the alternate site exists or assume the primary site's access paths and credentials work there |
| Test: process for storing backups at the alternate site | Backup job records showing transfers to the alternate site, transfer logs, and the schedule defined in the backup policy | Backups are described as replicated but transfer logs are missing, or copies stop for weeks without an alert |
| Test: process for retrieving backups from the alternate site | Restore exercise records showing data pulled from the alternate site, the restore timestamp, verification results and any gaps found | The test restored from local copies only; no retrieval from the alternate site has ever been exercised or recorded |
Implementing CP-6 from site selection to the first verified restore
This sequence takes CP-6 from a named alternate storage site to documented evidence that backup data can be retrieved from that site and restored. Each step produces an artifact an assessor can examine, interview against or test.
Define the alternate storage site and backup sets
Start by naming the alternate storage location and listing which backup sets it will hold, such as user-level data, system-level data and system documentation, matched to what the contingency plan treats as essential. The organization owns this decision, and the system owner and contingency planner sign it off. Done means a written scope statement that identifies the site, the backup sets, and the systems they cover, and that is referenced in the system contingency plan (CP-2). Confirm with your own environment which sites are geographically and operationally separate from the primary site before you commit.
Sign storage and retrieval agreements
Execute written agreements with the site owner or provider that cover storing backup information there and retrieving it within the times the recovery plan requires. Legal and procurement own the contract, and the contingency planner confirms that the terms match the scope from the previous step. The output is a signed agreement on file, along with any agreement for the primary storage site that CP-6 assessment methods ask examiners to see. Ask providers to describe retrieval procedures in writing, and confirm them before relying on them.
Document control equivalence against the primary site
Build a control mapping that compares the alternate site with the primary site for access control, encryption of backup data at rest and in transit, monitoring and logging, and environmental protection such as power, fire suppression and climate control. Each row names the primary control, the alternate control, the gap and the owner of any remediation. The output is a signed control mapping that shows equivalence or lists accepted differences with a plan to close them. Equivalence is what CP-6 asks for, so an unexplained gap is the most common finding to fix before assessment.
Configure and schedule replication or copy jobs
Configure the copy or replication jobs that move backup data to the alternate site, using the backup platform's own job definitions. For example, a Bareos Director can schedule backup and archive jobs and keep a catalog of backed-up files, while restic can copy snapshots to a second repository. The engineer records job names, schedules, retention settings and the storage destination in configuration under version control. Done means exported job definitions and a successful first run logged in the job history, which become the evidence an examiner reviews for the process.
Set recovery objectives for the high baseline enhancement
If the system is categorized at the high baseline, define the recovery time objective and recovery point objective that apply to restores from the alternate site, and confirm they match the values set in the contingency plan. The business owner approves the values, and the engineering lead confirms that the job schedules can meet the recovery point objective. The output is a short approved record stating each objective, the system it applies to, and the evidence that supports it. Moderate-baseline systems still need objectives in the plan, but the enhancement is required only at high.
Run and record a restore from the alternate site
Restore a defined sample of backup data from the alternate site into an isolated environment, then verify the restored files against known good values. Tools can help here: restic check with read-data options reads pack files back to confirm stored data is unmodified, and a Bareos restore can be run from a chosen backup date. The contingency team records who ran the test, the date and time, the source, the sample, the verification result and any issues. That restore record, with the job logs, is the first verified evidence that the alternate site works and should feed the next review of the contingency plan.
Which evidence passes CP-6 and how to keep it current between audits
An assessor testing CP-6 looks for a documented alternate site, proof that backups actually reach it, and proof that someone can restore from it. The six artifacts below connect those three points, and each one goes stale on its own schedule, so each needs a named owner and triggers for review.
Signed alternate storage site agreements
The written agreements with the alternate storage site and the primary site's storage arrangements are the first thing an examiner requests, because CP-6 requires agreements that allow backup information to be stored and retrieved. Check that each agreement names the site, the data types covered, retrieval conditions and the parties who can authorize a retrieval. Review the agreements when the hosting provider, site location or contact list changes, and when the backup scope grows to include new systems.
Primary and alternate site controls comparison
CP-6 requires the alternate storage site to provide controls equivalent to the primary site, so keep a side-by-side record of access control, encryption, environmental protection and monitoring at both locations. Mismatches are the usual finding, for example an encrypted primary volume paired with an unencrypted replica target. Update the comparison whenever a control changes at either site and re-check it as part of each contingency plan review.
Backup job configuration and catalog extracts
Job definitions and catalog records prove that copies reach the alternate site rather than sitting only on the primary. Export the job configuration that sends data to the alternate target and a catalog extract listing the stored copies and their dates. In Bareos, the Director schedules backup, restore and verify jobs and keeps a SQL catalog of backed-up files, which is the record to export. Refresh the extracts after every change to job schedules, storage targets or retention settings.
Restore test records from the alternate site
A backup at the alternate site only counts if it can be restored, so keep dated records of restores performed from that site, with the source, the target, the result and who ran the test. For repositories that support it, record integrity checks as well. restic's check command with the read-data option reads pack files back to confirm the stored data is unmodified. Schedule restore tests at a defined frequency and add an unscheduled test after any change to the storage path.
Contingency plan section naming the site
The system contingency plan should name the alternate storage site, describe how backups are retrieved from it and link to the agreements and restore procedures. Assessors compare the plan against the actual arrangement, so a plan that names a site no longer in use is a finding. Confirm the plan is version controlled, dated and approved, and update the section whenever the site, retrieval steps or responsible roles change.
Interview-ready role assignments
SP 800-53A bases part of its CP-6 assessment on interviews with personnel who hold alternate storage site responsibilities and with personnel who hold system recovery responsibilities. Keep a current roster that names each person, their role in retrieving backups, their deputy and how they are contacted out of hours. Staff should be able to describe the retrieval steps without reading from a document. Update the roster on every staff change and confirm it during each restore test.
What meeting CP-6 costs in money and effort
This table breaks the cost of meeting CP-6 into its components, showing who is paid, whether each cost is one-time or recurring, and what moves it up or down. NIST does not estimate compliance costs, so use the table to structure your quote requests rather than to predict totals. The main takeaway is that storage volume, retention and restore testing drive most of the recurring spend.
| Cost component | Who is paid and when | What drives it up or down | What to ask for in a quote |
|---|---|---|---|
| Alternate site or provider fees | Hosting provider or the owned alternate facility. Recurring. | Whether the site is a contracted facility, a second cloud region or an owned location; the number of systems covered and the service tier chosen. | Itemized monthly or annual fees, what the site includes, and what triggers extra charges during a declared event. |
| Storage capacity and transfer | Storage or cloud provider, or your own hardware refresh. Recurring. | Backup volume, retention periods, change rate and how often backups are copied to the alternate site; egress charges when restoring. | Price per terabyte per month, transfer and egress rates, and the retention assumptions the quote is based on. |
| Backup software licenses or open-source tooling | Software vendor (licenses) or no license fee for open source. One-time or recurring. | Commercial licenses priced per client, instance or capacity; self-hosted open-source tools such as Bareos or restic remove license spend but still need hosting and support time. | License model and renewal terms, support tier, and whether the quote covers the alternate site copy as well as the primary. |
| Engineering time for replication and restores | Your staff or an implementation partner for the setup work. One-time. | Number of systems in scope, heterogeneity of platforms, whether replication is automated, and how well existing backup jobs are documented. | Fixed-scope deliverables, the systems covered, and what is handed over: configuration, runbooks and evidence templates. |
| Legal time for storage and retrieval agreements | Your legal team or outside counsel. One-time, with renewals. | Number of providers involved, whether the alternate site is a third party, and how standard the provider's terms are. | Who drafts the agreement, the scope of storage and retrieval terms, and the renewal and notice periods. |
| Restore testing and evidence upkeep | Your operations staff or a partner on retainer. Recurring. | Test frequency set in your contingency plan, number of systems tested, and how much evidence is automated (for example, verification runs and logged restore results). | Test scope per cycle, evidence produced each time, and who reviews and retains the records. |
| External review or testing | Independent reviewer or testing firm. Optional, one-time or periodic. | Whether you want an outside view of the alternate site design or an independent restore exercise before an assessment. | Named deliverables, sampling approach and whether findings are documented for the assessor. |
| Auditor sampling | Independent assessor or auditor. Set by the auditor. | Assessment scope, the sample of backups and restores the auditor selects, and the quality of your evidence. | Ask the auditor which records and restore runs they will sample so you can prepare them in advance. |
How Bareos and restic produce CP-6 evidence
CP-6 is mostly about agreements and site equivalence, which no software can prove. The technical evidence still matters, because an assessor will ask whether backups actually reached the alternate site and whether they can be read back intact. Bareos and restic each produce part of that picture, and the caveat card marks where their evidence stops.
Bareos Director and job records
The Bareos Director schedules backup, restore and verify jobs and keeps a SQL catalog of the files it has backed up. For CP-6, the catalog and job history are the records that show copies were sent to the alternate storage location on a defined schedule. Check that job logs identify the storage target, that restores have been run from the catalog against the alternate copy, and that the catalog itself is backed up and protected.
Restore from the current or prior backup
Bareos restores files selected from the current backup or from one before a given date and time. Assessors testing the ability to retrieve backup information from the alternate site will expect a dated restore record, not a claim that restores are possible. Keep the restore request, the chosen point in time, the destination and the verification of restored content together as one evidence set for each test.
restic structural checks
The restic check command verifies the structural consistency of snapshots, trees and pack files. Adding --read-data or --read-data-subset makes restic read pack files back to confirm the stored backup data is unmodified. Run these checks against the repository held at the alternate site and retain the output, the repository identifier and the date, since that output is the integrity evidence an assessor will sample.
What these tools do not prove
Neither tool produces the written agreements for storing and retrieving backups at the alternate site, documentation showing the site has controls equivalent to the primary, or the site's physical location. Those records come from contracts, site assessments and the system contingency plan. Confirm with counsel that the AGPL-3.0-only terms of Bareos and the BSD-2-Clause terms of restic fit how your organization will deploy, modify and distribute them before relying on either in a contract or assessment.
Who does what for CP-6: your team, a partner and the auditor
Your organization owns CP-6 in full. The agreements with the alternate storage site, the choice of that site, the position that its controls are equivalent to the primary site, and the decision to accept any residual risk all sit with accountable staff, typically the system owner, the contingency planning lead and the risk owner. A partner can document these decisions and gather material for them, but cannot make them on your behalf.
- Site decision and agreements: Select the alternate storage site, sign the storage and retrieval agreements, and confirm who holds the contracts and the authority to invoke them.
- Equivalence position: Write down why the alternate site's controls are equivalent to the primary site's, covering access, encryption, monitoring and environmental protection, and keep that reasoning in the contingency plan.
- Recovery objectives: Set the recovery objectives that the high baseline enhancement CP-6(2) depends on, and confirm they match the business impact analysis.
- Risk acceptance: Record any gaps as accepted risks with a named approver and a review date.
- Ongoing ownership: Review the agreements and the site after system changes, provider changes and restore tests.
Before engaging anyone, confirm internally which of these decisions already have an owner and a written record.
An implementation partner such as DeployOpen prepares the technical side of CP-6 inside your environment: backup configuration, copy jobs to the alternate location, restore testing, and the documentation and evidence packages that an assessor will examine. This work is usually delivered under a fixed scope with deliverables and timelines agreed in writing before it starts. The partner does not decide the site, sign your agreements, or issue any assessment conclusion.
- Backup and copy jobs: Configure backup tools, such as Bareos for scheduled backup, restore and verify jobs, or restic for encrypted repositories, so that copies reach the alternate location.
- Restore testing: Run and record restore exercises, including integrity checks such as restic check with data reads, and capture the results as evidence.
- Documentation: Draft procedures, configuration records and evidence packages that map to the CP-6 determination statements for your review.
- Hardening and access: Apply controls that help the alternate copy match the primary site, such as access restriction and encryption settings.
- Scope boundaries: Agree in writing which systems, sites and tests are included, and who keeps the evidence afterward.
Ask any partner to show in writing which of these items it will deliver, and which it will leave to your staff or the auditor.
An independent auditor, assessor or certification body tests CP-6 against the SP 800-53A assessment procedure and states the conclusion. The assessor examines the contingency plan and the site agreements, interviews the people with alternate storage and recovery responsibilities, and tests the storage and retrieval process. Independence means the assessor cannot have designed or operated the controls it is testing.
- Examine: Review the contingency plan, the primary and alternate storage site agreements, and the configuration records.
- Interview: Speak with personnel responsible for the alternate site and system recovery to confirm they know their duties.
- Test: Observe the process for storing and retrieving backup information at the alternate site, often using a restore sample chosen by the assessor.
- Conclusion: Issue the assessment findings. A partner can help you prepare, but cannot issue reports, attestations or certifications.
- Separation: Avoid giving the same firm the implementation and the independent assessment unless your governance rules and the assessing authority permit it.
Confirm the assessing authority and its independence rules before you select an assessor.
Where CP-6 programs usually fall short and how to close each gap
CP-6 programs rarely fail because the alternate site is missing. They fail in the details: paperwork that lapsed, controls nobody compared, sites that share the same exposure, backups never restored, and recovery objectives that exist only on paper. Each card names one gap and the closing action an assessor will expect to see.
Agreements missing or expired
CP-6 expects agreements that cover both storing and retrieving system backup information at the alternate site. Teams often hold a signed agreement for the facility but not for retrieval, or the agreement lapsed after a provider change or renewal. Check that each agreement names the storage scope, retrieval terms, responsible contacts and a current end date. Close the gap by logging every agreement in a register with its review date and attaching the signed copy to the contingency plan evidence.
Equivalent controls assumed, not documented
CP-6 requires the alternate storage site to provide controls equivalent to the primary site, and assessors test that claim by comparison. Many programs assume a cloud region or colocation facility matches production because the provider is reputable. Build a side-by-side table covering access control, encryption, logging, environmental protection and media handling for both sites, then record each difference and the compensating measure. Ask the site owner for their own control evidence rather than relying on marketing material.
Alternate site too close to primary
Enhancement CP-6(1) asks for separation so the alternate site is not exposed to the same disruption as the primary. A second data hall on the same campus, or a second zone in the same regional grid, can fail together with the first. Confirm separation against the hazards your risk assessment identifies, such as flood, power, fire, network carrier or regional outage. Document the distance or independence reasoning, and record where the separation is a deliberate accepted risk instead of an oversight.
Backups copied but never restored
A copy of backup data at the alternate site proves storage, not recoverability. CP-6 assessment includes testing the organizational processes for storing and retrieving backups at that site, so a copy nobody has restored from is weak evidence. Schedule restore exercises that pull data from the alternate site rather than the primary, and check the restored output against expected content. Tools such as restic can read pack files back to confirm stored data is unmodified, and Bareos restore jobs can be run against alternate media to record the outcome.
High baseline recovery objectives undefined
At the high baseline, CP-6(2) adds recovery time and recovery point objectives for the alternate site's role. Programs often state a general target but never tie it to specific systems, or they never test whether the alternate storage supports those targets. Define the recovery time and recovery point for each system that depends on the alternate site, then run a timed retrieval and compare the result. Record any gap between the objective and the measured result as a plan of action item with an owner.
CP-6 questions buyers ask before bringing in a partner
How much does CP-6 cost to implement?
No supplied figure exists for CP-6 costs, and the price depends mostly on what the alternate storage site is and how much of it you already run. The main cost components are the site or provider contract (often recurring), storage capacity and transfer at the alternate location, the backup tooling and its licenses, the engineering time to replicate or copy backups and configure access, and the time your staff spend on agreements and restore tests. Costs usually rise with data volume, required recovery speed, the number of systems in scope and whether the site must match the primary site's controls in full. Ask any quote to split one-time setup from recurring storage and support, and to state which party owns the storage agreement. NIST does not estimate compliance costs, so treat any published number as a starting point to verify against your own environment.
How long does it take to put an alternate storage site in place?
The timeline depends mainly on how long the agreements take and how long it takes to prove that backups can be restored from the alternate site. Contract negotiation with a hosting or storage provider, security review of that provider, network and key setup, and at least one documented restore test all sit on the critical path. NIST does not set implementation timelines for SP 800-53 controls; those are left to the authorizing body or contract that requires them. A fixed-scope engagement sets dates in writing before work starts, so ask for milestones tied to the agreement signature, the first replicated backup and the first successful restore from the alternate site.
What does the client need to provide for a CP-6 engagement?
You need to provide decisions and access that only your organization can supply. Named system owners must confirm which systems and data are in scope and what recovery expectations apply. Procurement or legal must own the storage or hosting agreement and approve its terms for storing and retrieving backup information. Your team needs administrative access to the backup systems, the primary storage site documentation, network and identity configuration, and the current contingency plan so the alternate site can be checked against it. Plan for named staff to attend the restore test. Without these inputs, the partner cannot confirm equivalent controls or produce usable evidence.
Can we implement CP-6 in-house instead of hiring a partner?
Yes, a small scope with one primary site, a single provider and a few systems is often manageable in-house if your team already runs backups. The hard parts are usually the agreement terms, which must cover storing and retrieving backup information, and the restore test, which must show that the alternate site can actually recover systems. Teams new to these tasks often underestimate how long the test takes to plan and document. Consider outside help if you lack restore experience, if the alternate site must match the primary site's controls across several systems, or if an assessor will test the evidence closely. Whichever route you choose, your organization still owns the control.
Is CP-6 alone enough to pass an assessment?
No. CP-6 is one control in the contingency planning family and assessors test it alongside related controls. The SP 800-53 catalog names CP-2, CP-7, CP-8, CP-9, CP-10, MP-4, MP-5, PE-3, SC-36 and SI-13 as related controls, and an assessor will expect the contingency plan, backup procedures and recovery objectives to agree with where backups are stored. Evidence for CP-6 includes the signed alternate storage site agreements, the primary storage site agreements, documented procedures and restore test results. An independent assessor decides whether that evidence is sufficient for your authorization.
Does the low baseline require CP-6?
No. SP 800-53B selects CP-6 for the moderate and high baselines, not for the low baseline, and it is not part of the privacy baseline. Confirm the baseline that applies to your system from its security categorization and any agreement that requires a particular baseline, because contracts and authorizing bodies sometimes add controls beyond the baseline. Even where CP-6 is not required, a documented alternate storage location is still a sound way to protect backups against a site failure, and your own risk assessment may justify it.
How does an implementation partner differ from an auditor for CP-6?
An implementation partner prepares systems, configurations, procedures and evidence, while an independent auditor or assessor tests them and issues the findings. DeployOpen plans, implements, configures, backs up and documents self-hosted open-source platforms inside your own infrastructure, and it can prepare CP-6 evidence such as restore test records and configuration documentation. DeployOpen does not issue audit reports, attestations or certifications. Your organization owns the controls and the decision to accept them, and an independent assessor determines whether the control is met. Keep the two roles separate in your contract and your evidence trail.
How do we scope a fixed-scope quote for CP-6?
Scope a quote by listing the systems, their recovery expectations, the storage locations involved and the deliverables you expect. Ask the partner to state the scope, deliverables and timeline in writing before work starts, since most engagements are fixed-scope. A useful brief names the primary and alternate sites, the backup tooling in use or planned, the number of systems and data volume in scope, whether the alternate site must mirror the primary site's controls, and the evidence your assessor will need. Ask that the quote separate one-time setup, recurring support and any retainer for later restore testing. DeployOpen does not publish a price list, so a quote follows from the written scope.
How DeployOpen scopes and evidences CP-6 in your environment
DeployOpen works on CP-6 as an implementation partner: we prepare the alternate storage arrangements, backup platform configuration and evidence in your own infrastructure, while your organization owns the control. Only an independent auditor or assessor can test the control and issue a report.
How we scope
- Written scope names the systems, backup sets and primary storage sites that CP-6 covers in your environment.
- Scope records which alternate storage site your organization uses and the agreements that govern storing and retrieving backups there.
- Scope states whether moderate or high baseline enhancements CP-6(1) to CP-6(3) apply, and which recovery objectives are in force.
How we build
- We configure self-hosted backup tooling such as Bareos, with its Director scheduling backup and restore jobs against the alternate site.
- We set up restic repositories where needed and enable read-data verification so stored backup data can be confirmed as unmodified.
- We document the separation, accessibility and equivalent-control settings at the alternate site so an assessor can compare them with the primary site.
How we hand over
- Handover includes configuration records, restore test results and the agreement and contact evidence that an assessor will examine.
- Documentation maps each CP-6 determination statement to the artifact that supports it, for your assessor to review independently.
- Your staff receive a runbook for retrieving backups from the alternate storage site, covering who acts and in what order.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the fixed-scope work is delivered.
- A retainer can cover periodic restore tests from the alternate site and refresh of evidence after significant system changes.
- Quotes follow from the written scope, so ask for a breakdown of one-time setup and recurring retainer effort before signing.
