Essential Eight RB-ML3.1 Unprivileged user accounts cannot access their own backups
What it says
Unprivileged user accounts cannot access their own backups.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure basic user accounts are unable to access or manage their backup data.
This control ensures that basic, everyday user accounts in an organisation can't get into or mess with their own backup data. This is important because if an unprivileged user accidentally or purposely tampers with their backups, critical information might be lost or corrupted, especially in situations like ransomware attacks.
Free. Save your status, tasks and notes.
Why it matters
Uncontrolled backup access by unprivileged users can lead to loss or corruption of data, increasing recovery time and business disruption during attacks.
How to implement
System administrator should restrict backup access by configuring permissions so that unprivileged user accounts cannot view or manage their own backup files.
IT team should regularly review and update user account permissions to ensure they do not have access to their backup data, using a simple checklist or audit tool.
Security officer should implement and enforce a role-based access control policy that separates backup management privileges from basic user accounts.
IT manager should provide training to employees about the importance of backup security and the possible risks associated with unauthorised access.
Backup administrator should set up alerts or monitoring to detect any attempts by unprivileged accounts to access backups, using simple tools available within the backup solution.
Compliance officer should ensure documentation exists that outlines the organisation's backup security policies and procedures, making it clear who has access to what.
Keep it running
Regularly review access controls and audit logs to ensure unprivileged accounts remain isolated from their backups, preventing misuse or tampering.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Does the organisation have policies that prevent unprivileged accounts from accessing their own backups?
Look at
Check the current permission settings on the backup files and systems.
Good evidence
Policies clearly prevent access, and permissions are appropriately restricted with logs showing compliance.
- Check 2 of 2What an auditor asks for
Ask for
How often does the organisation review these access policies and permissions?
Look at
Examine recent audit logs and reports of access review activities.
Good evidence
Regular reviews are conducted with documented findings and actions taken, dated within the last six months.
Mappings
Closest match in ASD Information Security Manual: ISM-1813, Prevent unauthorised user access to backup data, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
E8-RB-ML3.1 requires that unprivileged accounts cannot access their own backups. ISO/IEC 27001:2022 Annex A 5.15 is broader, requiring the organisation to establish and implement access control policies and procedures across assets, which would include backup systems and data. E8-RB-ML3.1 represents a concrete, topic-specific rule that would be implemented under the wider policy framework required by Annex A 5.15.
This control partially meets A.8.3.
E8-RB-ML3.1 requires that unprivileged accounts cannot access their own backups. ISO/IEC 27001:2022 Annex A 8.3 broadly requires restricting access to information and associated assets in accordance with the access control policy, which encompasses backup data and backup repositories. E8-RB-ML3.1 is a specific restriction for one asset class (backups) and one user class (unprivileged users).
ASD Information Security Manual: 3 mappings
This control is equivalent to ISM-1813.
E8-RB-ML3.1 requires that unprivileged accounts cannot access their own backups. ISM-1813 states the same requirement: unprivileged user accounts cannot access their own backups. Both controls focus on preventing basic users from reaching backup repositories/copies of their own data, with effectively the same scope and intent.
This control partially meets ISM-1811.
E8-RB-ML3.1 requires that unprivileged accounts cannot access their own backups. ISM-1811 is broader, requiring backups to be retained in a secure and resilient manner, which typically includes restricting access to backup data and systems. E8-RB-ML3.1 is one specific access-control measure that contributes to meeting ISM-1811, but does not address retention, resilience, or broader backup governance.
- ISM-1928Encrypt and restrict access to Microsoft AD and Entra Connect server backupsPartially overlaps
This control partially overlaps ISM-1928.
ISM-1928 requires AD-related server backups to be securely stored and only accessible (readable) by backup administrator accounts, with ASD-approved encryption. E8-RB-ML3.1 requires that unprivileged accounts cannot access their own backups, aligning with the access restriction principle in ISM-1928. ISM-1928 is more targeted (specific Microsoft identity servers) and adds explicit cryptographic requirements, while E8-RB-ML3.1 is a general access-control requirement for backups regardless of system type.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-10.2Isolate backup repositories from general user environments and production workloadsPartially overlaps
This control partially overlaps IT.PRO-10.2.
IT.PRO-10.2 requires backup repositories to be isolated from user and production environments to prevent unauthorised access, modification or deletion; E8-RB-ML3.1 ensures unprivileged user accounts cannot access even their own backups, a stricter form of that separation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.