CP-6 is about where your backups live. Establish an alternate storage site, including the agreements needed to store and retrieve system backup information, and make sure that site provides controls equivalent to the primary site.
800-53 binds US federal systems and others by contract. For a small or mid size company it is a reference, and backup location questions are routine in vendor reviews.
What it means in practice
NIST says alternate storage sites are geographically distinct from the primary and hold duplicate copies of data in case the primary is unavailable. A geographically distributed architecture can count as an alternate storage site. For cloud teams that often means replicating backups to another region or another account, so one failure or one compromised credential cannot erase both copies.
Agreements cover environmental conditions, access rules, physical and environmental protection and how backup media is delivered and retrieved. The site should reflect the needs in your contingency plan.
Evidence to collect
- Backup architecture showing the alternate location and region.
- The agreement or provider terms covering storage and retrieval.
- Configuration showing replication, retention and encryption in the alternate site.
- Access control settings for the alternate location, showing they match the primary.
- A restore test that pulled data from the alternate site.
Common gaps
- Backups sit in the same account as production, and a compromised admin can delete both.
- The alternate region has weaker access controls.
- Retrieval was never tested from the alternate site.
How to implement it
Replicate backups to a separate region and a separate account with restricted write and delete rights. Test retrieval. The enhancements are CP-6.1 Separation from Primary Site, CP-6.2 Recovery Time and Recovery Point Objectives and CP-6.3 Accessibility.
Quick check
Can a second cloud region count as an alternate storage site?
Yes, if it is geographically distinct and provides equivalent controls. The guidance says geographically distributed architectures may be considered alternate storage sites.
