NIST 800-171 Controls · Media Protection

MP.2.126 — Protect backups of CUI at storage locations

CMMC Level 2SPRS if unmet: -3HIGH priority~6h to implement

Protect the confidentiality of backup CUI at storage locations.

What MP.2.126 means in plain English

Your backups contain copies of all your most sensitive data — including all of your CUI. If you protect the original but not the backup, the backup is the weak link. Backups must be encrypted (both on-site and off-site), access-controlled (only authorized people can restore from them), and physically secured (if kept on a physical drive, locked up). For your small company: encrypt your Microsoft 365 backups (Microsoft handles this automatically), encrypt any local backup drives with BitLocker, and store offsite backup drives in a locked, secure location — not in the same building as the originals.

The assessment question

“Are all backups containing CUI protected with encryption both in transit and at rest — with physical backup media stored securely and access to backup systems restricted to authorized personnel only?”

How to implement MP.2.126

Identify all backup locations: Microsoft 365 cloud backup, local NAS/external hard drives, any third-party backup service (Veeam, Backblaze) — document each in your Media Inventory.
For any local or external backup drives: encrypt with BitLocker and store in a locked cabinet or safe when not in active use — never leave them plugged in permanently without access controls.
For off-site backups: use a cloud backup service that encrypts data at rest and in transit (Backblaze B2 with client-side encryption, Azure Backup, or Microsoft 365 Backup) — confirm the encryption standard in the vendor's documentation.
Restrict backup system access: only the owner/administrator should have credentials to the backup system — create a dedicated backup service account and do not share credentials.
Test backup restoration quarterly: attempt to restore a small set of files and verify they restore correctly and the restored data matches the original — log the test results.

Evidence your assessor will ask for

Media Inventory listing all backup locations and their encryption status
BitLocker encryption status for all local and portable backup media
Cloud backup vendor documentation confirming encryption at rest and in transit
Backup system access control list showing restricted administrative access
Quarterly backup restoration test log with dates and results

Does AI prompt monitoring help with this control? Honestly, no.

MP.2.126 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Media Protection controls

MP.1.118

Protect system media containing CUI

MP.1.119

Limit access to CUI on system media

MP.1.120

Sanitize or destroy system media before disposal or reuse

MP.2.121

Mark media with necessary CUI markings and distribution limitations

MP.2.122

Control access to media containing CUI during transport

MP.2.123

Implement cryptographic mechanisms to protect CUI during transport

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment