Summary
Microsoft 365 backups aren’t federally required for contractors, but losing data can jeopardize deliverables, record retention, compliance evidence, and awards. Backup copies of CUI must be protected like the originals under NIST 800-171 and CMMC. Summit 7 partners with AvePoint for secure, immutable, flexible-storage backups supporting Commercial, GCC, and GCC High.
When we bring up Microsoft 365 backups, most clients first ask, “Is it required?” In most cases, they are not federally required to back up their data, but losing it could cause serious business disruptions ultimately affecting compliance, contracts, and business stability.
We’ll get into why backups matter and why AvePoint is Summit 7’s partner of choice.
Why backups matter regardless of the rules
Summit 7 chose AvePoint because it pairs strong security with flexible backup storage locations. For organizations handling CUI, where the backups are stored matters as much as whether they exist.
What’s at stake
- Missed deliverables and Continuity of Operations (COOP). If the files, designs, or records needed to do the work are gone, you’re unable to maintain continuous operations. Persistent failures can lead to cure notices, negative past performance ratings, or termination for default.
- Records you’re required to keep. Federal contracts carry record retention obligations, and you may find them in your subcontractor terms as well. Under FAR 4.703, contractors generally must keep records for three years after final payment. If those records are lost, you may not be able to support your invoices, timekeeping, or audits.
- Lost trust and lost awards. Primes and agencies look at your security posture when making awards. A serious data loss can affect the relationships and contracts you’re competing for.
- Compliance evidence. System security plans, policies, and assessment documentation are part of showing you meet your obligations. Losing them can slow or derail a self-assessment or audit.
Common causes of data loss
- Accidental or malicious deletion
- Ransomware or other destructive attacks
- Misconfigured policies or bulk changes that overwrite content
- Departing employees and orphaned accounts
- Sync errors and failed migrations
Microsoft protects the platform, but protecting your content, and being able to restore it to a known state, is your responsibility.
Why Summit 7 chooses AvePoint backups
When Summit 7 selected AvePoint as a cloud backup vendor, two things stood out: security, and flexibility in where backup data is stored. For organizations handling CUI, where the backups are stored matter as much as whether they exist.
- Comprehensive support for Microsoft 365 Commercial, GCC, and GCC High
- Flexible storage location options
- Restores data granularly down to item, version, and security settings
- Immutable, air-gapped backups
- Backups can be encrypted with client-owned keys
- Self-service recovery and 24/7 support available to non-managed clients
What do FAR CUI, Brilliant at the Basics, CMMC, and NIST 800-171 say about backups?
CUI backups are considered CUI under CMMC, NIST 800-171, and Brilliant at the Basics (BATB), so they need the same protection as the originals.
NIST SP 800-171 and CMMC
NIST SP 800-171 is the control set that CMMC and the FAR CUI rule build on. It requires that backup copies of CUI be protected with the same level of security as the original data, typically through encryption and access controls at the storage location.
Where your backups live and who can reach them matter as much as the backups themselves. Make sure your backup storage is secure, flexible, and built for CUI.
FAR CUI
The FAR Council’s June 2026 proposed rule, usually called the FAR CUI Rule, will create a government-wide framework for safeguarding CUI and reporting CUI incidents, using a new clause (FAR 52.240-7) and a new Standard Form that identifies the CUI in a contract. The proposal also includes a 72-hour window to report a suspected or confirmed CUI incident. After an incident, you need to know what was affected and be able to restore it.
Backup copies of CUI are also CUI, so they need to be protected as carefully as the original.
Brilliant at the Basics
BATB is a Department of War (DoW) CIO cybersecurity campaign, not a compliance framework, and you can’t be certified against it. It does signal where expectations are heading. The campaign adds tougher identity, asset, AI, OT, and resilience expectations beyond what is required by NIST 800-171.
Backups are an essential part of business resilience. The right backups make the difference between your business scrambling to recover from a serious incident and a near-immediate return to normal operation.
Which federal contractors benefit most from backups?
Backups are especially valuable for:
- GCC High and DoW-environment customers who need backup data to stay inside an appropriate boundary
- Defense contractors preparing for CUI and CMMC obligations who want recovery and incident readiness in place before they’re asked
- Organizations that have been through, or narrowly avoided, a data loss event
Start now
Your work is essential, and your business deserves the peace of mind that comes with quick data recovery. Reach out to a Summit 7 expert to learn more about protecting your environment from catastrophic data loss.
