ASD ISM 1511 Conduct and maintain regular data backups
What it says
Backups of data, applications and settings are performed and retained in accordance with business criticality and business continuity requirements.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure data backups are done based on business importance and kept for future recovery needs.
Regularly backing up your business data is like saving a copy of your important documents just in case something goes wrong, like a computer crash or a cyber attack. If you don't do this, you might permanently lose valuable information, leading to disruptions or even financial losses.
Free. Save your status, tasks and notes.
Why it matters
Without regular backups and retention aligned to business continuity needs, data, apps and settings may be unrecoverable after compromise or failure.
How to implement
Business owner should identify critical data: Determine what data is essential for daily operations or compliance.
This involves listing every piece of information that would cause a nightmare if lost, such as customer records, financial documents, and operational data.
IT team should schedule regular backups: Set up a routine for automatic data backups to make sure they happen regularly without fail.
This can be done using backup software that copies all crucial data to a secure off-site location or a cloud service.
Office manager should review backup locations: Ensure that backups are stored in multiple places, not just on the same computer or server.
This means using external hard drives stored off-site or a reliable cloud service to prevent data loss from incidents like office fires or burglaries.
Procurement should buy appropriate backup solutions: Choose backup solutions that fit the size and needs of the business.
This might involve purchasing external hard drives for small offices or subscribing to a cloud storage service for larger data needs.
Manager should test recovery: Regularly test that you can restore data from backups.
Do this by following the steps to recover files and verifying they're complete and accessible, ensuring that backups are actually useful in case of an emergency.
Keep it running
Define backup frequency and retention per system criticality; include applications and configuration; regularly test restores and verify integrity.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The data backup policy document: Request to see the written policy that outlines how often and what type of backups are performed.
Look at
Details about frequency, data covered, and storage locations.
Good evidence
Includes a clear schedule and covers all business-critical data.
- Check 2 of 5What an auditor asks for
Ask for
Recent backup logs: Request logs of recent backups to confirm they are regularly occurring.
Look at
The dates and times to ensure backups align with the policy.
Good evidence
Shows consistent entries with no large time gaps between backups.
- Check 3 of 5What an auditor asks for
Ask for
To see the backup storage locations: Request a demonstration or confirmation of where backups are stored.
Look at
Both physical and digital storage media to ensure they are secure and sufficient.
Good evidence
Includes multiple, secure locations like a cloud service and an off-site physical drive.
- Check 4 of 5What an auditor asks for
Ask for
The backup recovery test records: Request documentation of recent backup recovery tests to ensure backups can be restored.
Look at
Records noting who performed the test, when, and whether it was successful.
Good evidence
Details a recent successful test with confirmation that data was recovered.
- Check 5 of 5What an auditor asks for
Ask for
About any problems encountered during backup or recovery: Request a report of any recent issues with the backup process.
Look at
How problems were resolved and what changes were implemented to prevent recurrence.
Good evidence
Includes detailed problem descriptions and measures taken to prevent them again.
Mappings
Closest match in ASD Essential Eight: E8-RB-ML1.1, Backups aligned with business continuity needs, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.30.
ISM-1511 requires organisations to perform and retain backups of data, applications and settings in line with business criticality and business continuity requirements. Annex A 5.30 is broader, requiring ICT readiness for business continuity to be planned, implemented, maintained and tested against continuity objectives, of which backups are only one component. ISM-1511 is therefore a specific subset of the wider ICT continuity readiness expectations in Annex A 5.30.
This control partially overlaps A.8.13.
ISM-1511 requires backups of data, applications and settings to be performed and retained based on business criticality and business continuity requirements. Annex A 8.13 aligns by requiring backup copies to be maintained in accordance with an agreed backup policy and to be regularly tested for recovery. The overlap is strong on performing and maintaining backups, but Annex A 8.13 adds explicit testing and policy governance detail that ISM-1511 does not state, while ISM-1511 emphasises business criticality/BC requirements as the driver for retention.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-RB-ML1.1.
E8-RB-ML1.1 necessitates backups to align with business criticality and continuity needs. ISM-1511 reflects an equivalent requirement across backup scope and the alignment of retention to business requirements, thus both are congruent in setting expectations for business-driven backup performance.
This control is broader than E8-RB-ML1.2.
E8-RB-ML1.2 requires synchronising backups across data, applications and settings to enable restoration to a common point in time. ISM-1511 is broader as it requires performing and retaining backups in accordance with business criticality and continuity requirements, without being limited to synchronisation. Synchronisation in E8-RB-ML1.2 is a specific quality attribute that can sit within the wider backup regime described by ISM-1511.
This control partially overlaps E8-RB-ML1.3.
ISM-1511 requires backups of data, applications and settings to be performed and retained in accordance with business criticality and business continuity requirements. E8-RB-ML1.3 relates by requiring backups to be retained in a secure and resilient manner, addressing how backups are protected and stored. ISM-1511 focuses on ensuring backups exist and are retained to meet continuity needs, while E8-RB-ML1.3 adds security/resilience expectations that are not explicit in ISM-1511.
This control supports E8-RB-ML1.4.
E8-RB-ML1.4 requires organisations to test restoring data, applications, and settings from backups to a common point in time during disaster recovery exercises. ISM-1511 requires backups to be aligned with business continuity needs, ensuring that appropriate backups exist for E8-RB-ML1.4 testing.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.