Essential Eight RB-ML2.1 Prevent privileged user accounts from accessing others' backups
What it says
Privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user accounts.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure only backup administrators can access all backup data.
This control is about making sure that only the backup administrators can access all the backup data, including those from other privileged accounts. This is important to prevent unauthorised access to sensitive data and to protect it from being tampered with or deleted, which could cause major disruptions to the business.
Free. Save your status, tasks and notes.
Why it matters
If privileged accounts can access other users' backups, they can extract sensitive data or delete/alter backups, undermining recovery and causing disruption.
How to implement
The IT team should identify who the backup administrators are.
They need to ensure only these people have access to all backup data by setting specific permissions.
System administrators should review account permissions regularly.
They should ensure that privileged accounts do not have access to backups except for backup administrators.
The security officer should implement policies that restrict access to backup systems.
These policies should clearly state that only backup administrators are allowed such access.
The IT team should use software tools to enforce these permissions.
These tools can manage who has access to sensitive data and ensure compliance with policies.
Keep it running
Regularly review backup repository ACLs so only backup administrator accounts can access others' backups; alert on privileged access and verify exemptions.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Who has access to the backup data within your system?
Look at
Examine the access control list and permissions settings related to backup systems.
Good evidence
Only backup administrators should be listed with access permissions to all backup data. Other privileged accounts should be excluded.
- Check 2 of 2What an auditor asks for
Ask for
How do you ensure these restrictions are maintained over time?
Look at
Review documented procedures and logs showing regular permissions reviews and audits.
Good evidence
There should be records of routine checks and adjustments to access permissions, ensuring ongoing compliance with the control.
Mappings
Closest match in ASD Information Security Manual: ISM-1705, Restrict access to user account backups, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.3.
E8-RB-ML2.1 requires separating duties so privileged accounts (other than backup administrators) cannot access other accounts' backups. ISO/IEC 27001:2022 Annex A 5.3 supports this by mandating segregation of conflicting duties, which underpins the organisational design of separating backup administration from general privileged administration. Annex A 5.3 is higher-level and does not specify backup access enforcement mechanisms, whereas E8-RB-ML2.1 is an explicit technical access restriction for backups.
This control partially meets A.8.2.
E8-RB-ML2.1 requires a specific privileged-access restriction: privileged accounts (excluding backup administrators) must not be able to access other users' backups. ISO/IEC 27001:2022 Annex A 8.2 relates by requiring that privileged access rights are allocated and used in a restricted and managed way, which would encompass restricting privileged access to backup repositories. However, Annex A 8.2 is broader and does not explicitly call out backup separation or the backup administrator exception found in E8-RB-ML2.1.
ASD Information Security Manual: 5 mappings
This control is equivalent to ISM-1705.
ISM-1705 requires that privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user accounts. E8-RB-ML2.1 states the same restriction for privileged accounts accessing others' backups, with the same carve-out for backup administrators. The scope and intent align closely: limiting backup read/access pathways to the backup administrator role.
This control partially overlaps ISM-1706.
ISM-1706 requires that privileged user accounts (excluding backup administrator accounts) cannot access their own backups. E8-RB-ML2.1 restricts privileged accounts from accessing backups belonging to other accounts, which is a related backup access segregation concept. The candidate is about preventing cross-user backup access, while ISM-1706 is specifically about preventing self-access, so each covers a different misuse scenario.
This control partially overlaps ISM-1812.
ISM-1812 requires that unprivileged user accounts cannot access backups belonging to other user accounts. E8-RB-ML2.1 addresses access to others' backups as well, but focuses on restricting privileged accounts (excluding backup administrators) rather than unprivileged users. They overlap on the objective of preventing unauthorised cross-account access to backups, but each targets a different account class and threat path.
- ISM-1928Encrypt and restrict access to Microsoft AD and Entra Connect server backupsPartially overlaps
This control partially overlaps ISM-1928.
ISM-1928 mandates that backups of AD DS/AD CS/AD FS/Entra Connect servers are only accessible by backup administrator accounts and are encrypted using ASD-approved cryptography. E8-RB-ML2.1 requires privileged accounts (excluding backup administrator accounts) cannot access backups belonging to other accounts, reinforcing the privileged-access boundary that ISM-1928 relies on to keep sensitive backups confidential. ISM-1928 is narrower and system-specific (identity infrastructure backups) and includes encryption and secure storage requirements, while E8-RB-ML2.1 is a broader backup access-control rule not tied to cryptographic controls.
This control depends on ISM-2152.
ISM-2152 requires segregating backup servers/repositories/consoles from production and using separate administrative authentication for backup administration. This supports E8-RB-ML2.1 by reducing the ability of non-backup privileged accounts to traverse from production administration into backup environments and access other users' backups. E8-RB-ML2.1 focuses on logical access authorisation to backup data, whereas ISM-2152 focuses on environmental and admin-auth separation that helps enforce those authorisations.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.