Essential Eight RB-ML1.5 Unprivileged user accounts cannot access others' backups
What it says
Unprivileged user accounts cannot access backups belonging to other user accounts.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that unprivileged accounts can't access other users' backups.
This control is about making sure that people who don't have special permissions can't see or access other people's backup files. Imagine if someone in your office could look at your personal emails or documents just because they have access to the backup system-that's a huge privacy risk. By enforcing this control, you prevent unauthorised access and potential data leaks.
Free. Save your status, tasks and notes.
Why it matters
If unprivileged users can access other users' backups, sensitive data can be exposed, causing privacy breaches and unauthorised disclosure.
How to implement
IT team: Set restrictive permissions on backup storage locations so only authorised users can view or access these backups.
System administrator: Use user account management tools to ensure unprivileged accounts are not in groups with access to others' backups.
Security officer: Conduct regular access reviews for backup files to ensure compliance with the access policy, adjusting permissions as necessary.
System administrator: Audit backup configurations to ensure access controls are effective, reconfiguring any changes to maintain security.
Keep it running
Review backup ACLs regularly and confirm only owners/admins can read others' backup sets; investigate any cross-user access events in logs.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
How do you control access to backup files?
Look at
Examine the access permissions set on the backup storage systems.
Good evidence
There is a documented access control policy specifying who can access backup files, with permissions set to restrict access to unauthorised users.
- Check 2 of 3What an auditor asks for
Ask for
How often do you review user access to backups?
Look at
Review logs or records of access reviews.
Good evidence
Access reviews are performed quarterly, and logs show corrections made to any improper access.
- Check 3 of 3What an auditor asks for
Ask for
What measures are in place to prevent unauthorised access to backups?
Look at
Check audit logs and backup system configurations.
Good evidence
Audit logs show no unauthorised access attempts, and system configurations are set to deny access to unprivileged accounts.
Mappings
Closest match in ASD Information Security Manual: ISM-1812, Restrict backup access to unprivileged users, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
Annex A 5.15 requires establishing and implementing rules to control access to information and associated assets. E8-RB-ML1.5 specifically prevents unprivileged accounts from accessing other accounts' backups, which is an access rule protecting a particular information asset type (backups). The candidate is narrower because it addresses access to backups only, while Annex A 5.15 covers access control policies and procedures across all information assets and access methods.
This control partially meets A.8.3.
Annex A 8.3 requires access to information and associated assets to be restricted in accordance with an access control policy. E8-RB-ML1.5 relates by restricting unprivileged accounts from accessing backups belonging to other accounts, treating backups as protected information assets subject to access limits. Annex A 8.3 is broader because it applies to all information and asset types, not just backup repositories and cross-account access.
ASD Information Security Manual: 3 mappings
This control is equivalent to ISM-1812.
ISM-1812 requires that unprivileged user accounts cannot access backups belonging to other user accounts. E8-RB-ML1.5 states the same requirement, explicitly preventing unprivileged accounts from accessing other accounts' backups. The scope and intent align closely, with both focused on preventing cross-user backup access by unprivileged users.
This control partially meets ISM-1852.
E8-RB-ML1.5 requires that unprivileged accounts cannot access backups belonging to other accounts. ISM-1852 requires limiting unprivileged access to systems and resources to what is necessary for duties, which would include preventing unnecessary access to other users' backup data. E8-RB-ML1.5 is a specific least-privilege constraint focused on backup access, whereas ISM-1852 applies broadly across systems and resources.
This control partially overlaps ISM-1813.
ISM-1813 requires that unprivileged user accounts cannot access their own backup data. E8-RB-ML1.5 extends the access restriction to unprivileged accounts being unable to access other users' backups, which is adjacent but not the same as self-backup access. The controls overlap in restricting unprivileged access to backups, but they differ in the ownership context (self vs others).
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-10.2Isolate backup repositories from general user environments and production workloadsPartially overlaps
This control partially overlaps IT.PRO-10.2.
IT.PRO-10.2 requires backup repositories to be isolated from user and production environments to prevent unauthorised access, modification or deletion; E8-RB-ML1.5 ensures unprivileged user accounts cannot access backups belonging to other user accounts, one case of preventing unauthorised access.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.