ASD ISM 1515 Test backup restoration during disaster recovery
What it says
Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBackups should be restored regularly to ensure data can be retrieved in case of a disaster.
This control ensures that you regularly test your backup systems to make sure you can recover important data if something goes wrong, like a cyber attack or a natural disaster. It's crucial because if backups can't be restored when needed, you could lose critical business information, which could be devastating to your operations.
Free. Save your status, tasks and notes.
Why it matters
Failure to test backup restoration can prevent recovery to a common point in time, causing data loss, prolonged outage, and reputational harm.
How to implement
IT team should schedule regular backup restoration exercises.
They can start by selecting a non-critical system and restoring its data from backups in a test environment to check that everything works as expected.
System owners should document the restoration process.
Note every step taken during the restoration exercise, from accessing backup files to completing the restoration, so that this process can be followed easily in the future.
Managers should allocate time and resources for these exercises.
Ensure teams have necessary permissions and tools to execute the restoration without delays, prioritising it as part of risk management activities.
IT team should simulate varied disaster scenarios.
By testing restoration under different circumstances, like server failures or network outages, they ensure backups work in all kinds of situations.
Staff training should include backup restoration protocols.
Conduct hands-on workshops to familiarise relevant staff with the procedures for conducting restorations successfully.
Keep it running
During DR exercises, restore data, applications and settings to a common point in time and validate integrity, access and RTO/RPO results; record and fix gaps.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Documentation of recent backup restoration tests. Review the documents for details about the date, systems involved, and outcomes of the restoration exercises.
Good evidence
Includes evidence that tests were performed regularly and successfully, with any issues noted and addressed.
- Check 2 of 5What an auditor asks for
Ask for
To observe an actual backup restoration exercise.
Look at
How the team accesses backups and goes through the restoration steps.
Good evidence
Observation shows a smooth process where the team follows documented steps without confusion.
- Check 3 of 5What an auditor asks for
Ask for
Records of any restoration issues and how they were resolved.
Look at
The records for clear descriptions of the problems encountered and solutions implemented.
Good evidence
Record will show timely resolutions and improvements made to prevent similar issues.
- Check 4 of 5What an auditor asks for
Ask for
Feedback from staff who participated in restoration tests.
Look at
The feedback for any repeated themes or issues.
Good evidence
Would include positive feedback and suggestions for improvement, showing an engaged and informed staff.
- Check 5 of 5What an auditor asks for
Ask for
A list of systems included in tests.
Look at
Coverage of all critical systems over a planned schedule.
Good evidence
List shows comprehensive coverage and schedules that ensure all important systems are regularly tested.
Mappings
Closest match in ASD Essential Eight: E8-RB-ML1.4, Test backup restoration to a common point during disaster recovery, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.13.
ISM-1515 requires testing restoration of data, applications and settings from backups to a common point in time specifically during disaster recovery exercises. Annex A 8.13 requires backup copies to be maintained and regularly tested in line with the organisation's backup policy, covering broader backup testing expectations beyond disaster recovery exercising. ISM-1515 is a specific scenario and testing objective within the wider backup testing requirement of Annex A 8.13.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-RB-ML1.4.
E8-RB-ML1.4 requires organisations to test restoration of data, applications, and settings from backups to a common point in time as part of disaster recovery exercises. ISM-1515 states the same requirement with identical scope and intent, ensuring restoration to a common point during disaster recovery exercises. Implementing either control would satisfy the other.
This control depends on E8-RB-ML1.1.
ISM-1515 requires organisations to test restoring from backups to a common point in time as part of disaster recovery exercises. E8-RB-ML1.1 ensures backups are performed and retained according to business criticality and continuity needs, which helps define what must be recoverable and the restoration objectives to be tested. E8-RB-ML1.1 does not itself require conducting restoration tests, but it strengthens the basis and coverage of ISM-1515 exercises.
This control depends on E8-RB-ML1.2.
ISM-1515 requires organisations to test restoring data, applications and settings from backups to a common point in time during disaster recovery exercises. E8-RB-ML1.2 requires backups to be synchronised so that such a common point-in-time restoration is possible. Without the synchronisation in E8-RB-ML1.2, the restoration test in ISM-1515 cannot be meaningfully executed to a common point in time.
This control depends on E8-RB-ML1.3.
ISM-1515 requires regular testing of restoring from backups to a common point in time as part of disaster recovery exercises. E8-RB-ML1.3 focuses on retaining backups in a secure and resilient manner so they remain available and trustworthy for restoration. If backups are not securely and resiliently retained per E8-RB-ML1.3, ISM-1515 restoration testing may fail or provide unreliable outcomes.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.