Essential Eight RB-ML1.3 Backups retained securely and resiliently
What it says
Backups of data, applications and settings are retained in a secure and resilient manner.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure backups are kept securely and can withstand failures.
This control ensures that backups of your important data, applications, and settings are kept safe and can be easily recovered if something goes wrong. It's vital because if you lose your data due to a system failure or a cyber attack, secure backups are the only way to get your business back on track without incurring significant losses.
Free. Save your status, tasks and notes.
Why it matters
Without secure, resilient backups, cyber incidents can cause permanent data loss, prolonged downtime and significant financial harm.
How to implement
IT team: Identify which data, applications, and settings are critical to the business.
Do this by consulting with different departments to understand their needs and dependencies.
System administrator: Set up regular backup schedules for these critical elements.
Use a reliable backup tool or service that supports encryption to keep the data secure.
Security officer: Ensure that backup data is encrypted both during transfer and when stored.
This can be done by using backup software with built-in encryption options.
IT team: Routinely test the backup restoration process to ensure data can be recovered.
This involves performing a trial run of restoring a backup to make sure it works as expected.
System administrator: Protect backup access by ensuring only authorised personnel can modify or delete them.
Set user permissions in your backup system to restrict access.
Keep it running
Regularly verify backup integrity and test restores; keep backups protected from deletion/encryption (e.g., offline/immutable copies) to ensure reliable recovery.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
How often are backups performed and what is backed up?
Look at
Examine the backup schedule and list of items backed up.
Good evidence
A detailed schedule showing frequent backups of all critical data, applications, and settings.
- Check 2 of 3What an auditor asks for
Ask for
Are backups encrypted to ensure their security?
Look at
Check the encryption settings in the backup software.
Good evidence
Backup logs show data is encrypted during transfer and while stored.
- Check 3 of 3What an auditor asks for
Ask for
How do you test that backup restorations work?
Look at
Review records of recent backup restoration tests.
Good evidence
Reports from routine tests showing successful recovery of data to its original state.
Mappings
Closest match in ASD Information Security Manual: ISM-1811, Secure and resilient data backup retention, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.13.
E8-RB-ML1.3 requires backups of data, applications and settings to be retained securely and in a resilient manner. ISO/IEC 27001:2022 Annex A 8.13 requires maintaining backup copies and regularly testing them in line with an agreed backup policy, which includes but extends beyond secure/resilient retention into governance and testing. E8-RB-ML1.3 is one key outcome that would contribute to meeting Annex A 8.13, but Annex A 8.13 has broader procedural and testing expectations.
ASD Information Security Manual: 8 mappings
This control is equivalent to ISM-1811.
ISM-1811 requires backups of data, applications and settings to be retained in a secure and resilient manner. E8-RB-ML1.3 states the same requirement with effectively identical scope and intent. Implementing E8-RB-ML1.3 would largely satisfy ISM-1811 (and vice versa), noting only that ISM guidance may provide additional implementation detail beyond the Essential Eight statement.
- ISM-2151Technically enforced immutability protecting backups through their retention periodBroader than
This control is broader than ISM-2151.
ISM-2151 requires backups to be stored with technically enforced immutability so they cannot be modified or deleted for the entire retention period. E8-RB-ML1.3 requires backups to be retained in a secure and resilient manner, which can be achieved in part through immutable/WORM storage. However, E8-RB-ML1.3 is broader (covering resilience and secure retention generally), while ISM-2151 is a specific technical safeguard focused on preventing alteration/deletion during retention.
This control partially overlaps ISM-1511.
ISM-1511 requires backups of data, applications and settings to be performed and retained in accordance with business criticality and business continuity requirements. E8-RB-ML1.3 relates by requiring backups to be retained in a secure and resilient manner, addressing how backups are protected and stored. ISM-1511 focuses on ensuring backups exist and are retained to meet continuity needs, while E8-RB-ML1.3 adds security/resilience expectations that are not explicit in ISM-1511.
This control partially overlaps ISM-1547.
ISM-1547 requires organisations to develop, implement and maintain data backup processes and procedures. E8-RB-ML1.3 relates by requiring backups to be retained in a secure and resilient manner, which should be defined and enforced through those backup procedures. ISM-1547 is broader because it covers the existence and upkeep of procedures, whereas E8-RB-ML1.3 focuses on the security and resilience properties of backup storage.
This control partially overlaps ISM-1810.
ISM-1810 requires synchronised backups to enable restoration to a common point in time across data, applications and settings. E8-RB-ML1.3 overlaps by focusing on retaining backups securely and resiliently, which helps ensure synchronised backups remain available and trustworthy for restoration. ISM-1810 is about consistency of backup points, while E8-RB-ML1.3 is about protection and resilience of the backup storage and retention approach.
- ISM-1928Encrypt and restrict access to Microsoft AD and Entra Connect server backupsPartially overlaps
This control partially overlaps ISM-1928.
ISM-1928 requires backups of AD DS/AD CS/AD FS/Entra Connect servers to be encrypted using ASD-approved cryptography, stored securely, and accessible only to backup administrator accounts. E8-RB-ML1.3 similarly requires backups to be retained securely and in a resilient manner, which aligns with the secure storage and protection intent in ISM-1928. However, ISM-1928 is more specific on encryption standards (ASD-approved) and strict access limitation to backup administrator accounts, while E8-RB-ML1.3 is broader and less prescriptive about cryptography and access roles.
This control supports ISM-1515.
ISM-1515 requires regular testing of restoring from backups to a common point in time as part of disaster recovery exercises. E8-RB-ML1.3 focuses on retaining backups in a secure and resilient manner so they remain available and trustworthy for restoration. If backups are not securely and resiliently retained per E8-RB-ML1.3, ISM-1515 restoration testing may fail or provide unreliable outcomes.
This control supports ISM-1548.
ISM-1548 requires organisations to develop, implement and maintain data restoration processes and supporting procedures. E8-RB-ML1.3 supports ISM-1548 by requiring backups be retained securely and resiliently, which increases the likelihood restoration processes can be executed during incidents such as ransomware.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-10.1Back up data, applications and settings on schedule to encrypted, resilient storagePartially overlaps
This control partially overlaps IT.PRO-10.1.
IT.PRO-10.1 requires scheduled backups of important data, applications and settings to secure, resilient, encrypted storage that is immutable, offline, isolated or equivalently protected; E8-RB-ML1.3 requires those backups to be retained in a secure and resilient manner, the same storage aim without naming encryption or isolation.
- IT.PRO-10.2Isolate backup repositories from general user environments and production workloadsPartially overlaps
This control partially overlaps IT.PRO-10.2.
IT.PRO-10.2 requires backup repositories to be isolated from user and production environments to prevent unauthorised access, modification or deletion; E8-RB-ML1.3 requires backups to be retained in a secure and resilient manner, a broader aim that such isolation supports.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.