Essential Eight RB-ML1.4 Test backup restoration to a common point during disaster recovery
What it says
Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure data and apps can be restored to a common point using backups in disaster scenarios.
Imagine your computer system crashes, or a cyber attack hits, and you need to restore everything back to normal quickly. This control is about testing that you can actually bring back all your important data and applications from backups to the same point in time. If you don't do this, you could end up with bits and pieces missing, causing lots of headaches and maybe even loss of business.
Free. Save your status, tasks and notes.
Why it matters
Without testing restore capability, data loss and application inconsistency during a disaster could disrupt operations, leading to financial and reputational damage.
How to implement
The IT manager should schedule regular disaster recovery exercises to test backup restoration.
Use these exercises to simulate real-world scenarios where all data and applications need to be restored to test the effectiveness of current backup processes.
System administrators should ensure that backups are being made in a synchronised manner.
This means checking that the data and related applications are being backed up together so that, if needed, everything can be restored to the same point in time.
The security officer should review and implement secure storage solutions for backups.
This involves encrypting backup data and storing them in locations that are secure against physical and cyber threats.
IT staff should maintain clear records and documentation of backup processes.
This includes step-by-step guides and a clear schedule for when backups are taken and tested.
The business continuity manager should include backup testing results in their regular reports to management.
This helps to communicate any gaps and ensures continual improvement of backup and recovery processes.
Keep it running
Incorporate backup restores into routine DR exercises to confirm timely, coordinated recovery to the same point in time, avoiding data mismatch issues.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
When was the last disaster recovery exercise conducted for backup restoration?
Look at
Examine records of disaster recovery exercises or after-action reviews.
Good evidence
A report showing a recent disaster recovery test that includes the dates, scenario tested, and results documented, including any issues encountered and resolved.
- Check 2 of 3What an auditor asks for
Ask for
How do you ensure backups are synchronised for a common point in time restoration?
Look at
Check the procedures or system logs for backing up data and applications.
Good evidence
Documented procedures that show how and when data and applications are backed up together, ensuring they can be restored simultaneously.
- Check 3 of 3What an auditor asks for
Ask for
Are backups stored securely and in a way that supports quick recovery?
Look at
Review encryption methods and physical storage information.
Good evidence
Evidence of encryption standards being applied and documentation of secure storage locations, such as a trusted cloud provider or an off-site facility.
Mappings
Closest match in ASD Information Security Manual: ISM-1515, Test backup restoration during disaster recovery, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.30.
E8-RB-ML1.4 involves testing restoration from backups to a common point in time during disaster recovery exercises. Annex A 5.30 focuses on a broader ICT readiness for business continuity, including but not limited to backup restoration testing, stressing on overall continuity objectives.
This control partially meets A.8.13.
E8-RB-ML1.4 mandates testing restoration from backups to a common point in time as part of disaster recovery exercises. Annex A 8.13, however, requires backups to be maintained and regularly tested per a policy, encompassing more than disaster recovery restoration testing.
ASD Information Security Manual: 8 mappings
This control is equivalent to ISM-1515.
E8-RB-ML1.4 requires organisations to test restoration of data, applications, and settings from backups to a common point in time as part of disaster recovery exercises. ISM-1515 states the same requirement with identical scope and intent, ensuring restoration to a common point during disaster recovery exercises. Implementing either control would satisfy the other.
This control partially meets ISM-1555.
ISM-1555 requires creating a backup of mobile device data/applications/settings prior to overseas travel to reduce impact if the device is lost, seized, or compromised. E8-RB-ML1.4 relates by requiring testing of restoration from backups to a common point in time during disaster recovery exercises, which ensures the backups ISM-1555 relies on are actually recoverable. ISM-1555 is narrower because it does not require restoration testing or DR exercising, only that a backup be taken before travel.
This control supports ISM-0917.
E8-RB-ML1.4 requires organisations to test restoring data, applications, and settings from backups during disaster recovery exercises. ISM-0917 involves restoring from a known good backup during malware incidents, where E8-RB-ML1.4 proves the effectiveness under exercises.
This control depends on ISM-1511.
E8-RB-ML1.4 requires organisations to test restoring data, applications, and settings from backups to a common point in time during disaster recovery exercises. ISM-1511 requires backups to be aligned with business continuity needs, ensuring that appropriate backups exist for E8-RB-ML1.4 testing.
This control depends on ISM-1547.
E8-RB-ML1.4 requires testing of restoring data, applications, and settings from backups to a common point in time as part of disaster recovery exercises. ISM-1547 involves developing and maintaining backup processes, which support achieving E8-RB-ML1.4's objectives.
This control depends on ISM-1548.
E8-RB-ML1.4 requires organisations to test restoring data, applications, and settings from backups to a common point in time during disaster recovery exercises. ISM-1548 demands the development and maintenance of restoration processes, which are foundational for E8-RB-ML1.4 testing.
This control depends on ISM-1810.
E8-RB-ML1.4 requires organisations to test restoring data, applications, and settings from backups to a common point in time during disaster recovery exercises. ISM-1810 requires backups to be synchronised so that restoration to a common point in time is possible, functioning as a prerequisite for E8-RB-ML1.4.
This control depends on ISM-1811.
E8-RB-ML1.4 requires organisations to test restoration from backups to a common point in time during disaster recovery exercises. ISM-1811 focuses on the secure and resilient retention of backups so they are available for the E8-RB-ML1.4 restoration test.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-10.3Regularly test backup and restoration procedures against defined recovery objectivesPartially overlaps
This control partially overlaps IT.PRO-10.3.
IT.PRO-10.3 requires backups and restoration to be tested regularly against recovery time and recovery point objectives; E8-RB-ML1.4 requires restoring data, applications and settings to a common point in time to be tested in disaster recovery exercises, one form of that testing.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.