How do we handle classified records that are still sitting on system backups and disaster-recovery tapes after the live copies were processed?

Backup and disaster-recovery (DR) copies are one of the most commonly overlooked places classified information lingers. When a live record is downgraded, declassified, transferred, or destroyed, the same data often still exists on backup media created before that action. Treating only the “live” copy as authoritative leaves classified content uncontrolled on tapes, snapshots, and replicated storage.

Backups are still records you must control

A backup copy of a classified record carries the same classification level and handling requirements as the original. Until it is properly downgraded or destroyed, it remains subject to the same marking, access, storage, and accountability controls. The fact that a copy is “only a backup” does not lower its sensitivity or remove it from the agency’s recordkeeping obligations.

Why this is hard

• Lag in disposition. Backups are point-in-time snapshots, so a destroyed or declassified record can persist on media for the full retention period of that backup set.
• Aggregation risk. Tapes often mix classified and unclassified material, making selective deletion impractical.
• Format and access drift. Older DR media may require legacy hardware to read, complicating both review and verified destruction.

Practical principles

• Inventory where copies live. Map backup and DR systems against your records inventory so classified holdings on secondary media are known, not assumed.
• Set disposition that covers all copies. Retention and destruction schedules should explicitly address backup and DR media, not just the primary system.
• Align with security marking rules. Apply the same classification, downgrading, and declassification instructions to backup copies, and document when each step occurs.
• Use approved, verifiable destruction. When classified backup media reach end of retention, sanitize or destroy them using methods approved for that classification level, and keep a record of the action.
• Coordinate the right roles. Records officers, security/classification managers, and IT/DR teams should jointly own this so a gap in one area does not create exposure in another.

Bottom line

Processing the live copy is only part of the job. Classified information persists wherever it was duplicated, and your controls must follow it onto backups and DR tapes until those copies are lawfully declassified or destroyed.

For broader guidance, see our declassification topic hub.