The IAO will ensure data backup is performed at required intervals in accordance with DoD policy.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6172	APP6190	SV-6172r1_rule	CODB-1 CODB-2 CODB-3	Medium

Description
Without proper backups, the application is not protected from the loss of data or the operating environment in the event of hardware or software failure.

STIG	Date
Application Security and Development STIG	2014-04-03

Details

Check Text ( C-3058r1_chk )
Check the following based on the MAC level of the application. For MAC 3 applications: Validate backup procedures exist and are performed at least weekly. A sampling of system backups should be checked to ensure compliance with the control. For MAC 2 applications: Validate backup procedures exist and are performed at least daily. Validate recovery media is stored at an off-site location and ensure the data is protected in accordance with its mission assurance category and confidentiality level. This validation can be performed by examining an SLA or MOU/MOA that states the protection levels of the data and how it should be stored. A sampling of system backups should be checked to ensure compliance with the control. Verify that the organization tests backup information to ensure media reliability and information integrity. Verify that the organization selectively uses backup information in the restoration of information system functions as part of annual contingency plan testing. For MAC 1 applications: Validate that the procedures have been defined for system redundancy and they are properly implemented and are executing the procedures. Verify that the redundant system is properly separated from the primary system (i.e., located in a different building or in a different city). This validation should be performed by examining the secondary system and ensuring its operation. Examine the SLA or MOU/MOA to ensure redundant capability is addressed. Finding details should indicate the type of validation performed. Examine the mirror capability testing procedures and results to insure the capability is properly tested at 6 month minimum intervals. 1) If any of the requirements above for the MAC level of the application are not met, it is a finding.

Check Text ( C-3058r1_chk )

Check the following based on the MAC level of the application.

For MAC 3 applications:
Validate backup procedures exist and are performed at least weekly.

A sampling of system backups should be checked to ensure compliance with the control.

For MAC 2 applications:
Validate backup procedures exist and are performed at least daily.

Validate recovery media is stored at an off-site location and ensure the data is protected in accordance with its mission assurance category and confidentiality level. This validation can be performed by examining an SLA or MOU/MOA that states the protection levels of the data and how it should be stored.

A sampling of system backups should be checked to ensure compliance with the control.
Verify that the organization tests backup information to ensure media reliability and information integrity.

Verify that the organization selectively uses backup information in the restoration of information system functions as part of annual contingency plan testing.

For MAC 1 applications:
Validate that the procedures have been defined for system redundancy and they are properly implemented and are executing the procedures.

Verify that the redundant system is properly separated from the primary system (i.e., located in a different building or in a different city). This validation should be performed by examining the secondary system and ensuring its operation. Examine the SLA or MOU/MOA to ensure redundant capability is addressed. Finding details should indicate the type of validation performed. Examine the mirror capability testing procedures and results to insure the capability is properly tested at 6 month minimum intervals.

1) If any of the requirements above for the MAC level of the application are not met, it is a finding.

Fix Text (F-4484r1_fix)
Develop and implement backup procedures.