Essential Eight RB-ML1.1 Backups aligned with business continuity needs
What it says
Backups of data, applications and settings are performed and retained in accordance with business criticality and business continuity requirements.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure backups match business needs and help restore data after incidents.
This control is about making sure your business has backups that align with your company's needs and can be used to restore everything if something goes wrong, like a cyberattack or a system crash. It's crucial because without proper backups, you could lose important data and have a hard time recovering your operations.
Free. Save your status, tasks and notes.
Why it matters
Without reliable backups, data loss could halt operations, causing financial losses and damaging reputation if recovery after incidents is delayed.
How to implement
IT team should identify critical data, applications, and settings that need regular backups.
They can do this by reviewing the business continuity plan and prioritising items based on their importance to operations.
System administrators should schedule regular backups according to the priorities set.
They can use backup software to automate the process and ensure it aligns with the business's operational timelines.
Security officers should ensure that backups are stored securely.
This involves encrypting the backup files and storing them in a secure location, like a cloud service with robust security measures.
IT team should conduct routine tests of the backup restoration process.
They should perform these tests at least annually as part of disaster recovery exercises to make sure data can be restored quickly and effectively.
Network administrators should restrict backup access.
They need to set permissions so that only authorised personnel can view and manage backups, preventing unauthorised users from altering them.
Keep it running
Regularly verify backup integrity and test restores against business continuity targets so critical data, applications and settings can be recovered within required timeframes.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
How often are backups conducted and retained?
Look at
Check the backup schedule and compare it with the documented business continuity plan.
Good evidence
There is a clear schedule that aligns with the organisation's critical needs, and it is documented.
- Check 2 of 3What an auditor asks for
Ask for
How is backup restoration tested?
Look at
Review records of recent disaster recovery exercises.
Good evidence
Regular restoration tests are conducted, with post-exercise reports available showing successful recovery.
- Check 3 of 3What an auditor asks for
Ask for
What measures protect backups from unauthorised access?
Look at
Examine access control lists and backup storage security practises.
Good evidence
Backup access is limited to authorised personnel only, with detailed access logs to confirm this.
Mappings
Closest match in ASD Information Security Manual: ISM-1511, Conduct and maintain regular data backups, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control is broader than A.5.30.
Annex A 5.30 requires ICT readiness to be planned, implemented, maintained and tested based on business continuity objectives and ICT continuity requirements. E8-RB-ML1.1 mandates that backups are performed and retained in line with business criticality and business continuity requirements, which is one specific control measure underpinning ICT continuity. E8-RB-ML1.1 is narrower (backup performance/retention) while Annex A 5.30 encompasses additional continuity design and readiness activities beyond backups.
This control partially overlaps A.8.13.
Annex A 8.13 requires maintenance and regular testing of backups under a policy. E8-RB-ML1.1 mandates backups based on business criticality but is less explicit about testing frequency. Core operational intent is similar.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-1511.
E8-RB-ML1.1 necessitates backups to align with business criticality and continuity needs. ISM-1511 reflects an equivalent requirement across backup scope and the alignment of retention to business requirements, thus both are congruent in setting expectations for business-driven backup performance.
This control is broader than ISM-1811.
E8-RB-ML1.1 covers backups performed and retained according to business continuity needs. While ISM-1811 focuses on secure and resilient backup retention, E8-RB-ML1.1 encompasses broader business-driven alignment, covering overall backup strategy not limited to retention security.
This control partially meets ISM-1555.
ISM-1555 requires personnel to prepare mobile devices for overseas travel by recording device details, updating software, removing non-essential data/accounts, and backing up what remains. E8-RB-ML1.1 relates by setting an organisational requirement that backups of data, applications, and settings are performed and retained based on business criticality and continuity needs, which is one of the explicit actions in ISM-1555. ISM-1555 is narrower because it is travel-specific, while E8-RB-ML1.1 defines backup alignment and retention expectations across the organisation.
This control partially overlaps ISM-1547.
E8-RB-ML1.1 dictates backups aligned with continuity needs. ISM-1547 supports this through the development and maintenance of documented backup processes, enhancing operational governance crucial to ensuring alignment and retention fidelity.
This control supports ISM-1515.
ISM-1515 requires organisations to test restoring from backups to a common point in time as part of disaster recovery exercises. E8-RB-ML1.1 ensures backups are performed and retained according to business criticality and continuity needs, which helps define what must be recoverable and the restoration objectives to be tested. E8-RB-ML1.1 does not itself require conducting restoration tests, but it strengthens the basis and coverage of ISM-1515 exercises.
This control supports ISM-1548.
ISM-1548 requires organisations to develop, implement and maintain data restoration processes and supporting procedures. E8-RB-ML1.1 supports ISM-1548 by ensuring backups are performed and retained in line with business criticality and business continuity needs, which determines what restoration is possible and within what timeframes.
This control depends on ISM-0734.
ISM-0734 involves the CISO contributing to BC/DR plans so critical services are supported during disasters. ASD Essential Eight E8-RB-ML1.1 involves conducting and maintaining backups according to business criticality and continuity needs, a vital element for DR plan execution. E8-RB-ML1.1 is a specific operational control, complementing ISM-0734's governance requirement for fostering an effective BC/DR framework.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-10.1Back up data, applications and settings on schedule to encrypted, resilient storagePartially overlaps
This control partially overlaps IT.PRO-10.1.
IT.PRO-10.1 requires scheduled backups of important data, applications and settings to secure, resilient, encrypted storage that is immutable, offline, isolated or equivalently protected; E8-RB-ML1.1 requires those backups to be performed and retained in line with business criticality and continuity requirements, the core duty both share.
- IT.PRO-10.3Regularly test backup and restoration procedures against defined recovery objectivesPartially overlaps
This control partially overlaps IT.PRO-10.3.
IT.PRO-10.3 requires regular testing of backup and restoration procedures against recovery time and recovery point objectives; E8-RB-ML1.1 requires backups to be performed and retained in line with business criticality and continuity requirements, producing the backups that testing checks.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.