Examples include threat-aware copy data management. Responsive to a request to back up data, a threat level may be determined. Where the threat level is determined to be less than a threat level threshold, a data port between a first and second network domain may be opened. Conversely, the request may be denied where the threat level is determined to be at or greater than the threat level threshold.