Datto BCDR
by Kaseya
Covered
6
controls
Partial
2
controls
Gaps
5
controls
Overview
Datto BCDR by Kaseya is a backup & recovery solution that covers 6 NIST 800-171 controls (5% total coverage). It addresses key requirements in the backup & recovery domain for defense contractors pursuing CMMC compliance.
Implementation Notes
Deploy Datto BCDR with FIPS-validated configurations. Integrate with your SIEM for centralized audit logging. Review partial controls quarterly to identify supplementary tooling needs.
More Backup & Recovery Products
Implementation Guidance for Datto BCDR
Configure Datto BCDR to satisfy NIST 800-171 controls by implementing these key settings: For CP-9 (Information System Backup), enable automated daily backups with 3-2-1 backup strategy - three copies of data, two different media types, one offsite. Configure backup verification through Datto's Screenshot Verification technology to ensure recoverability. Set retention policies to meet organizational requirements, typically 30-90 days for incremental backups and 1-7 years for monthly archives. For CP-10 (Information System Recovery), establish Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) in Datto's continuity planning module. Configure automated failover to Datto's cloud infrastructure and document recovery procedures. For AC-4 (Information Flow Enforcement), implement Datto's encryption in transit (AES-256) and at rest capabilities. Generate assessment evidence through Datto's compliance reporting dashboard, including backup success/failure logs, recovery test results, and encryption status reports. Export these reports monthly for C3PAO assessment preparation. Integrate with existing SIEM solutions via Datto's API for centralized monitoring. Common misconfigurations include: failing to test recovery procedures monthly, inadequate encryption key management, insufficient backup scope (missing critical system configurations), and lack of documented recovery procedures. Ensure backup agents cover all CUI-processing systems and validate that virtual machine snapshots capture complete system state including memory dumps when required.
Gap Analysis & Compensating Controls
Datto BCDR leaves significant gaps in 5 critical NIST 800-171 control families. The largest gap is in Access Control (AC) domain, where controls AC-2 (Account Management), AC-3 (Access Enforcement), and AC-6 (Least Privilege) require dedicated identity management solutions like Active Directory or Okta. System and Information Integrity (SI) controls need endpoint detection tools such as CrowdStrike or Microsoft Defender for vulnerability scanning and malware protection. Audit and Accountability (AU) controls require SIEM platforms like Splunk or Microsoft Sentinel for comprehensive log management and correlation. Configuration Management (CM) controls need tools like Tanium or Microsoft SCCM for baseline configuration enforcement. To document these gaps, create POA&M entries for each missing control with specific remediation timelines. In your SSP, acknowledge Datto BCDR's limited scope and reference planned compensating controls. Priority order for gap closure: 1) Implement SIEM for AU controls (highest CMMC assessment weight), 2) Deploy endpoint protection for SI controls, 3) Strengthen identity management for AC controls, 4) Add configuration management tooling. Budget $50,000-$150,000 annually for complementary tools depending on organization size. Document all gap mitigation strategies with specific implementation dates and assign responsible personnel for each remediation effort.
Compliance Cost Estimate
Datto BCDR licensing ranges from $2,000-$8,000 per server annually, depending on storage capacity and feature requirements. For a typical 25-50 employee defense contractor, expect $15,000-$35,000 annually in licensing costs. Initial implementation requires 40-80 hours of professional services at $150-$200/hour ($6,000-$16,000). Ongoing monitoring and maintenance adds $3,000-$6,000 annually for managed services or dedicated staff time. Compared to competitors like Veeam ($1,500-$4,000 per server) or Acronis ($1,200-$3,500 per server), Datto's integrated disaster recovery capabilities justify the premium pricing. Total first-year cost including implementation: $24,000-$57,000. The solution's automated testing and cloud integration reduce ongoing operational costs compared to traditional backup solutions requiring manual intervention.
Compliance Cross-References
Datto BCDR directly satisfies DFARS 252.204-7012 backup and recovery requirements by ensuring CUI protection through encryption and secure storage. For CMMC Level 2, it addresses CP.2.1 (system backup), CP.2.2 (backup testing), and CP.2.3 (backup protection) assessment objectives. The solution's encryption capabilities support SC.2.1 (protect CUI confidentiality) when properly configured. However, additional tools are required for CMMC domains including Access Control (AC), Audit and Accountability (AU), and System and Information Integrity (SI). For FedRAMP alignment, Datto BCDR maps to CP-9 (Information System Backup), CP-10 (Information System Recovery and Reconstitution), and SC-28 (Protection of Information at Rest) controls. C3PAO assessors will verify backup completeness, recovery testing documentation, and encryption implementation. Organizations must demonstrate that Datto BCDR backup scope covers all CUI-processing systems and that recovery procedures are regularly tested and documented. Integration with other CMMC-compliant tools is essential for comprehensive coverage.
Frequently Asked Questions
How many NIST 800-171 controls does Datto BCDR cover?
Datto BCDR covers 6 of 110 NIST 800-171 controls (5%), with 2 partially covered and 5 gaps.
Can Datto BCDR alone satisfy CMMC Level 2?
No single tool covers all 110 NIST 800-171 controls. Datto BCDR covers 5% and should be part of a layered security stack addressing the remaining controls.
What controls does Datto BCDR not cover?
Datto BCDR does not cover controls ia-3-5-1, pe-3-10-1, ac-3-1-12, si-3-14-1, ra-3-11-1. These require supplementary solutions such as physical security controls, additional access management, or media protection tools.
Map Your Full Security Stack
See NIST 800-171 control coverage for 80+ security products.
Open NIST Tool MapperTrack Datto BCDR NIST 800-171 coverage updates with AI-powered intelligence
Signals matches SAM.gov opportunities to your profile, monitors regulatory changes, and alerts you before competitors. Free for 90 days.
Start Free — 90 Days