Email backups must meet schedule and storage requirements.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-18883	EMG3-007 EMail	SV-20679r2_rule	CODB-2	Medium

Description
Hardware failures or other (sometimes physical) disasters can cause data loss to active applications, and precipitate the need for expedient recovery. Ensuring backups are conducted on an agreed schedule creates a timely copy from which to recover active systems. Storing backup contents at a separate physical location protects the backup data from site-specific physical disasters. Backup schedule and storage location are determined in accordance with the MAC category and confidentiality level of the system.

Description

Hardware failures or other (sometimes physical) disasters can cause data loss to active applications, and precipitate the need for expedient recovery. Ensuring backups are conducted on an agreed schedule creates a timely copy from which to recover active systems. Storing backup contents at a separate physical location protects the backup data from site-specific physical disasters. Backup schedule and storage location are determined in accordance with the MAC category and confidentiality level of the system.

STIG	Date
Email Services Policy STIG	2014-03-11

Details

Check Text ( C-22537r3_chk )
Access the EDSP for intended backup schedule and storage provisions. Review artifacts, such as job logs, file locations, access protections and procedures for offline files, and storage methods that demonstrate compliance to the intended schedule and log storage requirements. If email backups are conducted according to the EDSP, on schedule and are stored appropriately, this is not a finding.

Fix Text (F-19580r2_fix)
Document the email backup strategy in the EDSP and perform backups on the schedule that is documented. Store the data as required.