ASD Essentials IT.PRO-10.1 Back Up Data, Applications and Settings on Schedule to Encrypted, Resilient Storage
What it says
Back up important data, applications and settings on a defined schedule to secure, resilient storage protected by encryption and immutable, offline, logically isolated or equivalent controls.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBacks up important data, apps and settings on a set schedule to encrypted storage that attackers cannot change or delete.
The organisation copies the data, software and settings it needs to recover from an attack or major failure. Schedules match how much data each service can afford to lose. To meet this, every important system is backed up on schedule, and missed or failed runs are fixed within a set time. Copies are encrypted and protected from change or deletion, for example locked for a set period, kept offline or cut off from other systems.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 3
- Business systems
- User devices (does not apply)
Why it matters
Attackers who encrypt or wipe systems often delete or damage backups first. Without current copies on protected storage, there may be nothing clean to restore. Unencrypted copies can also be stolen in the same attack.
How to implement
System owners and IT operations should list in a backup register the important data, applications and settings of every in-scope system.
Include settings for firewalls, the staff directory, cloud accounts and the backup platform itself.
The IT operations manager should write backup procedures naming an owner for each job.
Set each schedule from the service's recovery needs, such as how much recent data it can afford to lose.
Backup administrators should make encryption mandatory on every backup target, such as tape, removable media and cloud storage.
The security team should keep the encryption keys apart from the backups and limit them to authorised staff.
The infrastructure team should protect every backup store so copies cannot be changed or deleted, using locked (immutable), offline or walled-off storage.
Keep copies in separate locations, and any substitute method needs security team approval and written reasons.
The backup operations team should monitor every job, and investigate and fix each missed or failed backup within the set timeframe, confirming a successful re-run.
Regularly check the register against the asset list.
Keep it running
The backup operations team reviews job results on a set schedule. Extend coverage in ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems, then business systems. Make scope, schedule, encryption and protected storage standard steps whenever a system is built, changed or moved to the cloud. Don't rely on product defaults, or assume a cloud provider keeps usable copies.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the backup procedures and register entries for sample systems in each applicable ASD domain.
Look at
Whether backups run irregularly with no owner, important systems are missing, or apps and settings are skipped.
Good evidence
A managed process backs up all important data, apps and settings in every applicable ASD domain.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the backup schedules and the recovery needs they were based on.
Look at
Whether schedules are missing, left at product defaults, or don't match how much data can be lost.
Good evidence
Every important asset has a schedule that traces back to its service's recovery needs.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the encryption settings for each backup target and the key management records.
Look at
Whether any target holds unencrypted backups, or encryption is optional or off for some jobs.
Good evidence
All backup storage is encrypted, with keys held separately and access limited.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the locking, offline or isolation settings on each backup store, and approvals for equivalents.
Look at
Whether some stores lack these protections, locks can be cut short, or all copies share one location.
Good evidence
Every backup store is encrypted and protected from change or deletion, with copies in separate locations.
- Check 5 of 5What an auditor asks for
Ask for
Request backup job reports, failure tickets and the set fix timeframes for a recent period.
Look at
Whether failures went unnoticed, tickets closed without a successful re-run, or fixes missed the timeframe.
Good evidence
Schedules are met consistently, and each missed or failed backup is fixed within the timeframe.
ASD indicators of good practice (8)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(2)
- NE-1No managed backup process exists for important data, applications and settings.
- NE-2Backup storage is neither encrypted nor protected by immutable, offline, logically isolated or equivalent controls.
Partially effective(3)
- PE-1Important data, applications and settings are backed up, but backup schedules are not defined, do not cover all important assets, or are not consistently met.
- PE-2Backups are encrypted but no immutable, offline, logically isolated or equivalent resilience controls are consistently applied.
- PE-3Backups use immutable, offline, logically isolated or equivalent controls, but encryption is not consistently enforced.
Fully effective(3)
- FE-1All important data, applications and settings are backed up according to schedules defined by the organisation and aligned with their recovery requirements.
- FE-2Backup schedules are monitored, and missed or unsuccessful backups are identified, investigated and remediated within timeframes defined by the organisation.
- FE-3Backup storage is encrypted and protected by immutable, offline, logically isolated or equivalent controls.
Mappings
Closest match in ISO/IEC 27001: A.5.30, ICT Readiness for Business Continuity, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.30.
IT.PRO-10.1 requires important data, applications and settings to be backed up on a defined schedule to secure, resilient and protected storage. Reliable backups are a core component of the ICT readiness required by Annex A 5.30, because they make recovery in line with business continuity objectives and ICT continuity requirements possible. Annex A 5.30 is broader, requiring ICT readiness as a whole to be planned, implemented, maintained and tested, beyond the backup arrangements in IT.PRO-10.1.
This control partially meets A.8.13.
IT.PRO-10.1 requires important data, applications and settings to be backed up on a defined schedule to secure, resilient storage protected by encryption and immutable, offline, logically isolated or equivalent controls. This is a specific implementation of the backup copies of information, software and systems that Annex A 8.13 requires to be maintained, with explicit expectations for how those copies are protected. Annex A 8.13 is broader, also requiring backups to be regularly tested and managed in accordance with an agreed topic-specific policy on backup.
This control depends on A.8.24.
IT.PRO-10.1 requires backups of important data, applications and settings to be held on secure, resilient storage protected by encryption together with immutable, offline, logically isolated or equivalent controls. Encrypting backups depends on the cryptography rules and key management required by Annex A 8.24, since encrypted backups can only be restored if their keys are managed securely and remain available during an incident. Annex A 8.24 covers the use of cryptography across the organisation, while IT.PRO-10.1 relies on it for one element of backup protection.
ASD Essential Eight: 3 mappings
This control partially overlaps E8-RB-ML1.1.
IT.PRO-10.1 requires scheduled backups of important data, applications and settings to secure, resilient, encrypted storage that is immutable, offline, isolated or equivalently protected; E8-RB-ML1.1 requires those backups to be performed and retained in line with business criticality and continuity requirements, the core duty both share.
- E8-RB-ML1.2Ensure backups are synchronised for restoration to a common point in timePartially overlaps
This control partially overlaps E8-RB-ML1.2.
IT.PRO-10.1 requires scheduled backups of important data, applications and settings to secure, resilient, encrypted storage that is immutable, offline, isolated or equivalently protected; E8-RB-ML1.2 requires those backups to be synchronised so they can be restored to a common point in time, adding a consistency requirement.
This control partially overlaps E8-RB-ML1.3.
IT.PRO-10.1 requires scheduled backups of important data, applications and settings to secure, resilient, encrypted storage that is immutable, offline, isolated or equivalently protected; E8-RB-ML1.3 requires those backups to be retained in a secure and resilient manner, the same storage aim without naming encryption or isolation.
ASD Information Security Manual: 1 mapping
This control partially overlaps ISM-1547.
IT.PRO-10.1 requires scheduled backups of important data, applications and settings to secure, resilient, encrypted storage that is immutable, offline, isolated or equivalently protected; ISM-1547 requires data backup processes and procedures to be developed, implemented and maintained, which underpin those backups.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.