Back-up copies of the application software or source code must be stored in a fire-rated container or stored separately (offsite).

From Application Security and Development Security Technical Implementation Guide

Associated with: CCI-000540

SV-84979r1_rule Back-up copies of the application software or source code must be stored in a fire-rated container or stored separately (offsite).

Vulnerability discussion

Application developers and application administrators must take steps to ensure continuity of development effort and operations should a disaster strike. Steps include protecting back-up copies of development code and application software.Improper storage of the back-up copies can result in extended outages of the information system in the event of a fire or other situation that results in destruction of the back-up as well as the operating copy.To address this risk, copies of application software and application source code must be stored in a fire-rated container or separately (offsite) from the operational or development environments.

Check content

When reviewing a COTS or GOTS application, verify that a back-up copy of the software is stored in a fire rated container or is stored separately (offsite) from the operational environment. Determine if application development is done in-house. If application development occurs in-house and source code is available, verify a back-up copy of the source code is kept in a fire-rated container or stored offsite from the development environment. If back-up copies of the application software or source code are not stored in a fire-rated container or stored separately (offsite) from their respective environments, this is a finding.

Fix text

Store a back-up copy of the application software and source code in a fire-rated container or store it separately (offsite) from their respective environments.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.