ASD Essentials IT.PRO-10.3 Regularly Test Backup and Restoration Procedures Against Defined Recovery Objectives
What it says
Conduct regular testing of backup and restoration procedures to ensure that backups are reliable and capable of meeting defined recovery time objectives and recovery point objectives.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishTests backups and restore steps regularly to prove backups work and can meet defined targets for downtime and data loss.
Backups only matter if they can be restored. The organisation regularly tests its backup and restore steps on important systems, such as rebuilding a server from last night's backup. Each test is checked against two targets: how quickly the system must work again (recovery time objective) and how much recent data can be lost (recovery point objective). To meet this, every important system is tested each cycle, results are recorded and gaps are fixed.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 3
- Business systems
- User devices (does not apply)
Why it matters
Without tested restores, the organisation may learn during a ransomware attack that its backups are incomplete, damaged, too slow or already deleted. A failed restore of the staff directory or management tools can stall every system that depends on them.
How to implement
The IT service continuity owner should agree recovery time and recovery point objectives for each important asset with its business owner.
Set a risk-based test cycle, and make sure written backup and restore procedures exist.
Backup administrators should test the backup procedures each cycle, checking that each backup is complete and undamaged.
Confirm it captures the asset's data, applications and settings, and runs often enough to meet its recovery point objective.
System owners should restore real backups into a separate test area using the written procedure, timing it until the service works.
Include full-system restores, such as rebuilding a whole server, not just single files, and get the business owner's sign-off.
The backup service owner should keep a test plan that schedules every important asset within the cycle.
Reuse existing restore tests, such as disaster recovery exercises, where they cover the same assets and targets.
The test lead should record measured recovery time and recovery point against each objective.
Log every gap as a tracked item with an owner, update the procedures and retest once fixed.
Keep it running
The backup service owner runs restore testing as scheduled work, not a glance at backup job reports. Cover systems in ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems, then business systems. Run multi-system tests in real recovery order, because many systems need the directory, password vaults and management tools first. Update the test plan whenever systems, backup tools or recovery targets change.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the backup and restore procedures, recovery objectives and test cycle for important assets.
Look at
Whether procedures exist and are current, or assets lack recovery objectives or a set test cycle.
Good evidence
Every important asset has current procedures, set recovery objectives and a risk-based test cycle.
- Check 2 of 5What an auditor asks for
Ask for
Request the latest cycle's backup test records, including checks that backups are complete and undamaged.
Look at
Whether backup procedures were tested beyond job success reports, or backups miss applications or settings.
Good evidence
Tested backups prove complete and recent enough to meet their recovery point objectives.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the latest restore test reports for sample assets from different ASD domains.
Look at
Whether restores failed, missed their recovery time or point objectives, or passed without measured times.
Good evidence
Each sampled restore worked and met its objectives, with measured times and the owner's sign-off.
- Check 4 of 5What an auditor asks for
Ask for
Request the test plan and the list of important assets in each applicable ASD domain.
Look at
Whether important assets or whole ASD domains went untested this cycle, or tests covered single files only.
Good evidence
Every important asset in every applicable ASD domain has a restore test in the current cycle.
- Check 5 of 5What an auditor asks for
Ask for
Request the register of gaps found in testing, with retest results for closed items.
Look at
Whether failures lack a fix item, recur between tests, or were closed without a retest.
Good evidence
Results are recorded, and every gap is fixed, retested and reflected in the procedures.
ASD indicators of good practice (9)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(3)
- NE-1No restoration test has been conducted within the test cycle defined by the organisation.
- NE-2No backup or restoration procedures exist.
- NE-3Restoration testing demonstrates that backups cannot be restored, or consistently fail to meet defined recovery time or recovery point objectives.
Partially effective(3)
- PE-1Restoration testing has been conducted but does not cover all important assets.
- PE-2Backup procedures exist but have never been tested.
- PE-3Testing has been conducted but coverage is incomplete or some tests did not meet the expected recovery time or recovery point objectives.
Fully effective(3)
- FE-1Restoration testing covering important assets is conducted within the test cycle defined by the organisation.
- FE-2Testing validates that restoration meets the expected recovery time and recovery point objectives.
- FE-3Test results are documented and gaps identified during testing are remediated.
Mappings
Closest match in ISO/IEC 27001: A.5.30, ICT Readiness for Business Continuity, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.30.
IT.PRO-10.3 requires regular testing of backup and restoration procedures against defined recovery time and recovery point objectives. Restoration testing against these objectives is a specific part of the ICT readiness testing required by Annex A 5.30, which is driven by business continuity objectives and ICT continuity requirements. Annex A 5.30 is broader, covering the planning, implementation, maintenance and testing of all ICT readiness arrangements, not only backup restoration.
This control partially meets A.8.13.
IT.PRO-10.3 requires regular testing of backup and restoration procedures to confirm that backups are reliable and can meet defined recovery time and recovery point objectives. This directly implements the regular testing element of Annex A 8.13, using recovery objectives as explicit test criteria. Annex A 8.13 is broader, also requiring backup copies of information, software and systems to be maintained in line with an agreed topic-specific policy on backup.
ASD Essential Eight: 2 mappings
This control partially overlaps E8-RB-ML1.1.
IT.PRO-10.3 requires regular testing of backup and restoration procedures against recovery time and recovery point objectives; E8-RB-ML1.1 requires backups to be performed and retained in line with business criticality and continuity requirements, producing the backups that testing checks.
This control partially overlaps E8-RB-ML1.4.
IT.PRO-10.3 requires backups and restoration to be tested regularly against recovery time and recovery point objectives; E8-RB-ML1.4 requires restoring data, applications and settings to a common point in time to be tested in disaster recovery exercises, one form of that testing.
ASD Information Security Manual: 1 mapping
This control partially overlaps ISM-1548.
IT.PRO-10.3 requires regular testing of backup and restoration procedures against recovery time and recovery point objectives; ISM-1548 requires data restoration processes and procedures to be developed, implemented and maintained, the procedures such testing exercises.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.