Essential Eight RB-ML1.6 Prevent unprivileged user accounts from modifying and deleting backups
What it says
Unprivileged user accounts are prevented from modifying and deleting backups.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure non-admin users cannot change or remove backup files.
This control is about making sure that regular staff members can't change or delete important backup files. Just think about how bad it would be if a virus or a mistake wiped out all your company's critical data. These backups are your safety net, and you want only trusted staff to have the power to alter them.
Free. Save your status, tasks and notes.
Why it matters
Without this control, insiders or malware could modify or delete backups, preventing recovery after ransomware or outages and causing major data loss.
How to implement
IT team: Review user permissions on the backup system to ensure that only administrators can modify or delete backup files.
Use permission settings in the backup software to enforce this.
System administrator: Set up alerts to notify when backup files are accessed or attempted to be modified.
Use available logging features in the backup management tool to monitor access.
Security officer: Regularly audit user accounts and their permissions to ensure compliance with backup access policies.
Conduct this review quarterly.
IT team: Use encryption for backup files so that even if accessed, they cannot be easily modified or corrupted.
Set up encryption through the backup system settings.
Keep it running
Restrict backup delete/modify rights to backup admins only; enforce separate accounts/MFA and regularly audit permissions to keep backups immutable.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
What measures are in place to prevent non-admin users from modifying backups?
Look at
Inspect user access logs and permission settings for the backup system.
Good evidence
Logs show that only admin accounts have write permissions on backups, and logs are routinely checked for unauthorised access attempts.
- Check 2 of 2What an auditor asks for
Ask for
How often are user permissions reviewed?
Look at
Examine records of permission audits or reviews and their frequency.
Good evidence
Permissions for backup access are reviewed every three months, with documented outcomes.
Mappings
Closest match in ASD Information Security Manual: ISM-1814, Prevent backup modifications by unprivileged users, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
Annex A 5.15 requires access control policies and procedures that govern who can access and change information and systems. E8-RB-ML1.6 implements a specific access rule by preventing unprivileged accounts from modifying and deleting backups. This is a subset of the broader access control policy requirements in Annex A 5.15, focused specifically on protecting backup integrity.
This control partially meets A.8.13.
E8-RB-ML1.6 requires that unprivileged accounts are prevented from modifying and deleting backups. Annex A 8.13 requires organisations to maintain and regularly test backup copies in line with a backup policy, and integrity of backups is strengthened when unprivileged users cannot tamper with them. E8-RB-ML1.6 supports Annex A 8.13 by improving the trustworthiness of backups, but Annex A 8.13 is broader and covers backup processes and testing beyond access restrictions.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-1814.
E8-RB-ML1.6 requires that unprivileged accounts are prevented from modifying and deleting backups. ISM-1814 states the same requirement using effectively identical scope and intent for access controls on backups. Implementing ISM-1814 would largely satisfy E8-RB-ML1.6 for this specific outcome.
This control partially meets ISM-1811.
E8-RB-ML1.6 requires that unprivileged accounts are prevented from modifying and deleting backups. ISM-1811 is broader, requiring backups to be retained in a secure and resilient manner, which typically includes access controls, immutability and protected storage. E8-RB-ML1.6 maps as a specific access-control mechanism that contributes to meeting ISM-1811's broader retention and resilience outcome.
This control partially overlaps ISM-1707.
E8-RB-ML1.6 requires that unprivileged accounts are prevented from modifying and deleting backups. ISM-1707 addresses a related but different actor group by preventing most privileged accounts (excluding backup administrators) from modifying and deleting backups, which strengthens overall backup integrity. The controls overlap on the objective of protecting backups from unauthorised change, but differ materially in scope (unprivileged vs privileged accounts).
This control partially overlaps ISM-1708.
E8-RB-ML1.6 requires that unprivileged accounts are prevented from modifying and deleting backups. ISM-1708 focuses on restricting backup administrator accounts from modifying or deleting backups during the retention period, protecting against insider and ransomware-style abuse via admin paths. Both protect backup immutability, but ISM-1708 is retention-period and admin-role specific, whereas E8-RB-ML1.6 is about unprivileged accounts generally.
- ISM-1928Encrypt and restrict access to Microsoft AD and Entra Connect server backupsPartially overlaps
This control partially overlaps ISM-1928.
E8-RB-ML1.6 requires that unprivileged accounts are prevented from modifying and deleting backups. ISM-1928 requires sensitive identity-service backups to be encrypted, stored securely and only accessible to backup administrator accounts, which indirectly prevents unprivileged modification by excluding them entirely. The overlap is protection of backup integrity via access restriction, but ISM-1928 is narrower to specific server types and adds encryption and secure storage requirements not explicit in E8-RB-ML1.6.
- ISM-2151Technically enforced immutability protecting backups through their retention periodPartially overlaps
This control partially overlaps ISM-2151.
ISM-2151 requires a technical immutability mechanism that prevents any modification or deletion of backups until retention expires. E8-RB-ML1.6 focuses on preventing unprivileged accounts from modifying or deleting backups, which aligns with part of the immutability objective. However, ISM-2151 goes further by requiring protection even from administrators/attackers and by tying the protection explicitly to the retention period, while E8-RB-ML1.6 is limited to unprivileged accounts.
This control depends on ISM-2152.
ISM-2152 requires segregation of backup infrastructure from production and separate administrative authentication for backup administration. This supports E8-RB-ML1.6 by making it harder for unprivileged production users (or compromised user sessions) to reach backup systems to modify or delete backups. E8-RB-ML1.6 specifies the access outcome (prevent modification/deletion), while ISM-2152 specifies a structural separation that helps achieve it.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-10.2Isolate backup repositories from general user environments and production workloadsPartially overlaps
This control partially overlaps IT.PRO-10.2.
IT.PRO-10.2 requires backup repositories to be isolated from user and production environments to prevent unauthorised access, modification or deletion; E8-RB-ML1.6 prevents unprivileged user accounts from modifying and deleting backups, one specific case of that protection.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.