Essential Eight RB-ML2.2 Privileged user accounts cannot modify or delete backups
What it says
Privileged user accounts (excluding backup administrator accounts) are prevented from modifying and deleting backups.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure privileged users can't change or remove backups, except backup admins.
This control is about making sure that people with special access to your systems, like IT administrators, can't change or delete your important backups unless they are specifically responsible for backups. This is important because if someone accidentally or deliberately deletes your backups, or if a hacker gets hold of an admin account, you could lose all your data and not be able to recover it.
Free. Save your status, tasks and notes.
Why it matters
If privileged users can delete or alter backups, attackers can remove recovery points, increasing ransomware impact and causing irrecoverable data loss.
How to implement
The IT team should have a clear list of who is responsible for backups and ensure only these backup administrators can modify backups.
They can use permission settings in the backup software to control access.
The system administrator should regularly review user accounts with admin privileges.
They can do this by running a user access report to identify any accounts with backup modification rights.
Security officers should conduct regular training for all staff involved with system management to ensure they understand who is allowed to modify backups and why these controls are in place.
The IT team should implement a logging system that records anytime someone tries to modify or delete a backup.
This can be done by enabling logging features in the backup management system.
Keep it running
Audit backup repository ACLs regularly so only backup administrator accounts can modify or delete backups; alert on any permission changes.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Who is allowed to modify or delete backups in your organisation?
Look at
Examine the access control list or permissions settings for the backup software.
Good evidence
The system should clearly show that only designated backup administrators have the ability to modify or delete backups.
- Check 2 of 2What an auditor asks for
Ask for
How often do you review who has access to modify backups?
Look at
Request the schedule and logs from recent access reviews.
Good evidence
Access reviews are conducted regularly, such as monthly or quarterly, and the logs show that only appropriate personnel have modification access.
Mappings
Closest match in ASD Information Security Manual: ISM-1707, Restrict backup modifications by privileged users, which asks for the same thing.
ASD Information Security Manual: 9 mappings
This control is equivalent to ISM-1707.
E8-RB-ML2.2 requires that privileged accounts (except backup administrator accounts) are prevented from modifying or deleting backups. ISM-1707 states the same requirement with the same exception, directly aligning on both scope (privileged users) and protection objective (immutability/deletion prevention). Implementing ISM-1707 would largely satisfy E8-RB-ML2.2 for this backup protection outcome.
This control partially meets ISM-1811.
E8-RB-ML2.2 requires that privileged accounts (excluding backup administrator accounts) cannot modify or delete backups. ISM-1811 requires backups to be retained in a secure and resilient manner, a broader outcome that typically includes controls like immutability, protected storage, and recovery resilience. E8-RB-ML2.2 is one specific access-control safeguard that helps achieve ISM-1811's wider secure-retention requirement.
This control partially overlaps ISM-1705.
E8-RB-ML2.2 requires that privileged accounts (excluding backup administrator accounts) cannot modify or delete backups. ISM-1705 limits privileged accounts from accessing other users' backups, reducing the opportunity for those accounts to reach backup repositories in the first place. ISM-1705 is about access scoping (who can see which backups), while E8-RB-ML2.2 is about preventing destructive or altering actions even if access exists.
This control partially overlaps ISM-1706.
ISM-1706 requires that privileged user accounts (excluding backup administrator accounts) cannot access their own backups. E8-RB-ML2.2 prevents privileged accounts from modifying or deleting backups, which addresses integrity and anti-ransomware objectives for backup stores. Both constrain what privileged users can do with backups, but ISM-1706 targets confidentiality/unauthorised reading of one's own backups whereas E8-RB-ML2.2 targets tampering and deletion.
This control partially overlaps ISM-1708.
E8-RB-ML2.2 requires that privileged accounts (excluding backup administrator accounts) cannot modify or delete backups. ISM-1708 instead restricts backup administrator accounts from modifying or deleting backups during the retention period, addressing a different actor while still aiming to protect backup integrity. Both reduce the risk of backup tampering, but E8-RB-ML2.2 does not constrain backup admins and ISM-1708 is specifically time-bound to retention.
This control partially overlaps ISM-1814.
E8-RB-ML2.2 requires controls that prevent privileged accounts (except backup administrators) from modifying or deleting backups. ISM-1814 prevents unprivileged users from modifying or deleting backups, which complements the same integrity goal but for a different user class. Together they harden backup protection across privilege levels, but neither control fully covers the other's targeted actor set.
- ISM-1928Encrypt and restrict access to Microsoft AD and Entra Connect server backupsPartially overlaps
This control partially overlaps ISM-1928.
E8-RB-ML2.2 requires privileged accounts (other than backup admins) to be unable to modify or delete backups. ISM-1928 requires sensitive server backups to be encrypted, stored securely, and only accessible to backup administrator accounts, which strongly limits who can reach backups and therefore helps enforce E8-RB-ML2.2's intent. ISM-1928 is narrower to specific AD-related systems and emphasises confidentiality and secure storage, not just modification/deletion prevention.
- ISM-2151Technically enforced immutability protecting backups through their retention periodPartially overlaps
This control partially overlaps ISM-2151.
ISM-2151 requires backups to be immutable so they cannot be modified or deleted for the duration of retention, including by privileged users. E8-RB-ML2.2 similarly aims to prevent privileged accounts (excluding backup administrators) from modifying or deleting backups. The overlap is the prevention of backup tampering, but ISM-2151 is stronger and more specific by mandating a technical immutability control and by explicitly covering all actors, including backup administrators, until retention expiry.
This control depends on ISM-2152.
ISM-2152 requires backup infrastructure to be segregated from production environments and administered via a separate authentication mechanism. This supports E8-RB-ML2.2 by helping ensure production privileged accounts cannot reach backup systems to modify or delete backups, because administrative access is isolated and separately controlled. E8-RB-ML2.2 is primarily an access restriction outcome, while ISM-2152 is an architectural and authentication segregation requirement that helps achieve that outcome.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.