CMMC doesn’t ask whether your backups restore. Most organizations read that as good news.
It isn’t relief. It’s a gap in the checklist, not a gap in the risk.
What CMMC Actually Checks, and What It Doesn’t
NIST SP 800-171 requires protecting the confidentiality of backup CUI at storage locations, control 3.8.9. That’s a real, assessed requirement, and it’s the one most organizations focus on because it’s the one an assessor will ask about.
Testing whether a backup restores isn’t in that requirement, or anywhere else in the 110 controls. NIST SP 800-171 states its own boundary directly: “The contingency planning, system and services acquisition, and planning requirements are not included within the scope of this publication due to the tailoring criteria.” Backup restoration testing lives inside contingency planning. It was tailored out on purpose, because NIST SP 800-171 protects confidentiality, not availability.
An assessor will never ask to see a restore test. That doesn’t mean the backup works. It means nobody with assessment authority is checking.
Having a Backup and Recovering From One Are Different Claims
A backup job that completes on schedule proves the job ran. It doesn’t prove the data inside it opens, restores to the right system state, or comes back in a timeframe that matters to whoever is waiting on it.
Encryption keys expire. Retention policies quietly prune something nobody flagged as critical. A restore path that worked against last year’s tenant configuration doesn’t automatically work against this year’s. None of that shows up until the day someone actually needs the backup, which is the worst possible day to find out.
The confidentiality question, where does the backup live and who can read it, is the one 3.8.9 forces an answer to. The restoration question, does it actually come back, is the one nobody is forcing an answer to at all.
What AgileDefend Already Commits To
AgileDefend’s own page already names this. Backup and disaster recovery is listed as one of the criteria that separates a CMMC-focused MSP from a generic one, and the page states plainly what the managed program delivers: continuous monitoring, configuration held to the controls the contract requires, documentation kept current for assessment, and fast recovery when something breaks.
Fast recovery is a claim about the same restoration question this piece opened with. A completed backup job and a genuinely fast, working recovery aren’t the same thing, and the gap between them is exactly what an assessment will never surface first.
The Assumption That Costs the Most
The organizations most exposed here aren’t the ones without backups or without a compliant storage location. They’re the ones who read “assessors don’t check this” as “this isn’t a risk,” when it only ever meant “nobody is going to make you find out early.”
A completed backup job is not the same claim as a working restore. One of those claims an assessor will validate. The other one, an outage will.
A completed backup job is not the same claim as a working restore. One of those claims an assessor will validate. The other one, an outage will.
AgileDefend’s backup and disaster recovery commitment is built around exactly this gap, not just where the data lives. Explore whether AgileDefend already covers this for your environment.
When Was the Last Time Anyone Actually Restored From One of Your Backups?
