Essential Eight RB-ML3.3 Backup administrators cannot modify or delete backups during retention
What it says
Backup administrator accounts are prevented from modifying and deleting backups during their retention period.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure backup admins can't change or remove backups until retention ends.
This control is all about making sure that backup administrators can't change or delete important backup data until it's no longer needed. This is crucial because if backup copies are altered or lost too soon, it could leave us with no way to recover key information if something goes wrong, like a data breach or system failure.
Free. Save your status, tasks and notes.
Why it matters
If backups can be altered or deleted prematurely, critical data recovery following incidents like cyber attacks or system failures may be impossible.
How to implement
IT team should ensure backup software settings are configured to prevent administrators from modifying or deleting backups during the retention period.
This can be done by setting strict permissions and roles within the software.
Security officer should review and update access control lists regularly to ensure they reflect current staff roles and responsibilities.
This means checking who has access to backup systems and adjusting permissions as needed.
System administrator should implement logging on backup systems to monitor and record any attempts to modify or delete backups during their retention period.
Enable detailed logging features available in the backup software.
IT manager should establish a policy that clearly defines retention periods for different types of data.
This involves collaborating with business units to understand the importance and required retention times of various datasets.
Compliance officer should provide training to backup administrators on security protocols and the importance of retaining backups without alteration.
Offer workshops or e-learning sessions on data protection and security responsibilities.
Keep it running
Regularly verify backup access controls so admin accounts cannot modify or delete backups during the retention period.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
Can you describe the process for preventing backup modification or deletion during the retention period?
Look at
Examine access control settings and the backup software configuration.
Good evidence
Backup software settings restrict all modification and deletion actions for backup administrators during the retention period, and this is enforced by structured access control policies.
- Check 2 of 3What an auditor asks for
Ask for
How do you ensure that the correct retention policies are being followed for all data backups?
Look at
Review documented retention policies and compare them against system configurations for adherence.
Good evidence
Retention policies are clearly documented, regularly reviewed, and the system configurations enforce these policies effectively.
- Check 3 of 3What an auditor asks for
Ask for
What methods are used to detect and log unauthorised access or changes to backups?
Look at
Check security logs and monitoring systems for evidence of logging and alert configurations.
Good evidence
Security logs are actively monitored, and alerts are set up to notify administrators of any attempts to modify or delete backups during retention.
Mappings
Closest match in ASD Information Security Manual: ISM-1708, Prevent backup modifications during retention, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.13.
Annex A 8.13 requires organisations to maintain backups and regularly test them so they are usable for recovery. E8-RB-ML3.3 hardens backup integrity by preventing backup administrator accounts from modifying or deleting backups during their retention period, reducing the risk that backups become unavailable or untrustworthy. This is a protective measure that strengthens Annex A 8.13 outcomes, but it is not the same requirement as maintaining and testing backups under a policy.
ASD Information Security Manual: 6 mappings
This control is equivalent to ISM-1708.
ISM-1708 requires that backup administrator accounts are prevented from modifying or deleting backups during their retention period. E8-RB-ML3.3 states the same restriction on backup administrator accounts for the duration of retention. The scope and intent align closely (immutability/WORM-style protection against admin tampering until retention expiry).
This control partially meets ISM-1811.
ISM-1811 requires backups to be retained securely and resiliently, which includes protecting them from tampering and deletion during the retention window. E8-RB-ML3.3 relates by mandating a specific protection mechanism: preventing backup administrators from modifying or deleting backups during their retention period. E8-RB-ML3.3 is one concrete subset control that helps achieve secure, resilient retention, while ISM-1811 encompasses additional resilience measures (for example, storage hardening and survivability) beyond administrator deletion protections.
This control partially overlaps ISM-1707.
ISM-1707 focuses on preventing non-backup administrators from modifying/deleting backups, whereas E8-RB-ML3.3 constrains backup administrators from making changes during specified retention periods. They both aim to protect backup integrity but are applied to different roles, and E8-RB-ML3.3 includes retention-timing conditions not found in ISM-1707.
This control partially overlaps ISM-1814.
E8-RB-ML3.3 requires that backup administrator accounts cannot modify or delete backups during their retention period. ISM-1814 also prevents modification/deletion of backups, but for unprivileged user accounts rather than backup administrators. The controls overlap in protecting backup integrity, but differ in threat model and scope (backup admins versus unprivileged users) and E8-RB-ML3.3 is retention-period specific.
- ISM-1928Encrypt and restrict access to Microsoft AD and Entra Connect server backupsPartially overlaps
This control partially overlaps ISM-1928.
ISM-1928 requires backups of specific identity services (AD DS, AD CS, AD FS and Entra Connect) to be encrypted, stored securely, and only accessible to backup administrator accounts. E8-RB-ML3.3 complements this by adding an immutability requirement that prevents even backup admin accounts from modifying or deleting backups, enhancing protection against tampering. ISM-1928 focuses on confidentiality and restricted access, while E8-RB-ML3.3 emphasizes integrity/availability of backups.
- ISM-2151Technically enforced immutability protecting backups through their retention periodPartially overlaps
This control partially overlaps ISM-2151.
ISM-2151 requires a technically enforced immutability mechanism that blocks modification or deletion of backups until their retention period ends. E8-RB-ML3.3 requires backup administrator accounts to be prevented from modifying or deleting backups during retention, which is a key threat model ISM-2151 addresses. E8-RB-ML3.3 is role-specific (backup administrators), whereas ISM-2151 is an implementation requirement (immutability) that protects against a broader set of actors and methods of deletion/tampering.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-10.2Isolate backup repositories from general user environments and production workloadsPartially overlaps
This control partially overlaps IT.PRO-10.2.
IT.PRO-10.2 requires backup repositories to be isolated from user and production environments to prevent unauthorised access, modification or deletion; E8-RB-ML3.3 stops even backup administrator accounts modifying and deleting backups during their retention period, a strict form of that protection.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.