ASD ISM 1547 Develop and maintain data backup procedures
What it says
Data backup processes, and supporting data backup procedures, are developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure data backup processes and procedures are created, used, and kept up to date.
Backing up your data means making extra copies of important files and storing them somewhere safe. This matters because if your main copy is lost or corrupted, due to something like hacking or accidental deletion, you could lose important information and end up with big problems. Regular backups are your safety net to recover quickly and keep things running smoothly.
Free. Save your status, tasks and notes.
Why it matters
Without robust backup procedures, data loss from cyber attacks or system failures can disrupt operations and damage reputation.
How to implement
Business owners should identify all critical data and systems that need backing up by assessing which files and applications are crucial to business operations.
This can be done by listing out all the data types and their importance to daily functions.
The IT team should choose the right backup methods and schedule, such as daily backups to a secure cloud service.
This involves evaluating available backup solutions, considering both cost and reliability, and implementing the choice that fits best with the business needs.
Managers should ensure the backup process is documented in simple terms so anyone responsible can understand and follow the steps.
Create a clear, step-by-step guide that includes how to start a backup, where backups are stored, and who to contact if something goes wrong.
System administrators should regularly test backup restorations to ensure they can actually recover data when needed.
This means periodically selecting a backup file and attempting to restore it to check for any issues.
The IT team should keep track of backup logs and audits to spot any irregularities or failures in the process.
Setting up automatic logging can help, and reviewing these logs monthly can ensure problems are caught early.
Keep it running
Verify backups weekly, ensuring data integrity and restoration capability; automate tests and monitor for anomalies.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The data backup policy document: Request to see written policies that outline how and when data backups occur.
Look at
Whether the document includes timelines, responsible personnel, and types of data being backed up.
Good evidence
A detailed, up-to-date policy that covers frequency, responsibility, and scope of data backup.
- Check 2 of 5What an auditor asks for
Ask for
A recent backup schedule: Request a copy of the backup calendar or schedule.
Look at
Whether it lists specific dates and times when backups are performed.
Good evidence
A regularly updated schedule that matches the backup policy with completed entries for past backups.
- Check 3 of 5What an auditor asks for
Ask for
A successful restoration test report: Request evidence showing that data restoration from a backup has been tested recently.
Look at
Whether the test includes details of what data was restored and any issues encountered.
Good evidence
A report confirming the full restoration of data without errors, including any corrective actions taken if issues were found.
- Check 4 of 5What an auditor asks for
Ask for
Access to backup logs: Request logs that show backup activities over the past few months.
Look at
The consistency of backup times and any logged errors or failures.
Good evidence
Logs showing regular and error-free backups, with any issues documented and resolved quickly.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of backup storage security: Request information on how backup data is protected while stored.
Look at
Whether the storage method includes access controls and encryption.
Good evidence
Documentation or demonstration showing secure storage practices, such as encrypted backups and restricted access.
Mappings
Closest match in ISO/IEC 27001: A.5.30, ICT readiness for business continuity, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.30.
Annex A 5.30 requires ICT readiness for business continuity to be planned, implemented, maintained and tested against business continuity objectives and ICT continuity requirements. ISM-1547 involves documented and maintained data backup processes and procedures, which are a foundational ICT continuity capability, though Annex A 5.30 is broader, emphasising end-to-end ICT continuity readiness and testing.
This control partially overlaps A.8.13.
Annex A 8.13 requires backup copies of information, software and systems to be maintained and regularly tested in accordance with an agreed backup policy. ISM-1547 requires organisations to develop, implement and maintain data backup processes and supporting procedures, which directly contributes to the 'maintained' aspect of Annex A 8.13. ISM-1547 does not, on its face, require regular testing, so it is supportive and partially aligned rather than equivalent in scope.
ASD Essential Eight: 4 mappings
This control partially overlaps E8-RB-ML1.1.
E8-RB-ML1.1 dictates backups aligned with continuity needs. ISM-1547 supports this through the development and maintenance of documented backup processes, enhancing operational governance crucial to ensuring alignment and retention fidelity.
- E8-RB-ML1.2Ensure backups are synchronised for restoration to a common point in timePartially overlaps
This control partially overlaps E8-RB-ML1.2.
ISM-1547 requires organisations to develop, implement, and maintain data backup processes and procedures. E8-RB-ML1.2 relates by specifying a concrete procedural/technical requirement: backups must be synchronised so restoration can occur to a common point in time. ISM-1547 is broader because it does not mandate synchronisation specifically, but it would typically include it where required by business needs.
This control partially overlaps E8-RB-ML1.3.
ISM-1547 requires organisations to develop, implement and maintain data backup processes and procedures. E8-RB-ML1.3 relates by requiring backups to be retained in a secure and resilient manner, which should be defined and enforced through those backup procedures. ISM-1547 is broader because it covers the existence and upkeep of procedures, whereas E8-RB-ML1.3 focuses on the security and resilience properties of backup storage.
This control supports E8-RB-ML1.4.
E8-RB-ML1.4 requires testing of restoring data, applications, and settings from backups to a common point in time as part of disaster recovery exercises. ISM-1547 involves developing and maintaining backup processes, which support achieving E8-RB-ML1.4's objectives.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-10.1Back up data, applications and settings on schedule to encrypted, resilient storagePartially overlaps
This control partially overlaps IT.PRO-10.1.
IT.PRO-10.1 requires scheduled backups of important data, applications and settings to secure, resilient, encrypted storage that is immutable, offline, isolated or equivalently protected; ISM-1547 requires data backup processes and procedures to be developed, implemented and maintained, which underpin those backups.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.