ASD ISM 1548 Develop and maintain data restoration processes
What it says
Data restoration processes, and supporting data restoration procedures, are developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOrganisations must create and keep updated processes for restoring data.
Organisations need to have clear methods for bringing back their data if it's lost or damaged. This is important because losing important information can disrupt operations and lead to financial and reputational damage. By having a reliable plan, you can ensure that everything runs smoothly even after unexpected problems.
Free. Save your status, tasks and notes.
Why it matters
Without documented restoration processes, data loss events can cause extended outages, missed RTO/RPOs and reputational harm.
How to implement
IT team should create a detailed plan for data restoration that includes the types of data to restore and the processes for doing so.
This plan should be written in simple language and easily accessible to anyone who might need it.
Managers should make sure that the data restoration plan is regularly reviewed and updated as needed.
This means scheduling reviews twice a year to incorporate any changes in the organisation's data storage or backup procedures.
Staff responsible for data should run regular practice drills to test the data restoration processes.
They can do this by simulating a data loss scenario and following the restoration plan to ensure everything works as expected.
Business owners should ensure that there is a clear chain of command for who is responsible during a data restoration event.
This can be done by having a list of contact details and duties is compiled and circulated to the relevant team members.
Procurement officers should ensure that any external backup solutions or services are in line with the restoration processes set by the organisation.
They need to regularly check that third-party services can restore data within the necessary timeframes.
Keep it running
Regularly test restoration procedures; document roles, RTOs/RPOs, backup locations, required tools, and system dependencies for recovery.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The organisation's data restoration plan: Verify that it includes detailed steps for how data will be restored.
Look at
Clarity, completeness, and whether it covers all critical data.
Good evidence
Will be a comprehensive plan easily understood by non-technical staff.
- Check 2 of 5What an auditor asks for
Ask for
Records of data restoration drills or tests: Check for documentation of when these tests were conducted and what the outcomes were. Good evidence of compliance includes regular tests with successful restoration times recorded.
- Check 3 of 5What an auditor asks for
Ask for
To see the policy regarding data backup and restoration responsibilities.
Look at
Roles and responsibilities clearly defined for each part of the process. Good evidence will have the names of current responsible staff and their contact information.
- Check 4 of 5What an auditor asks for
Ask for
To see contracts or agreements with external backup providers: Ensure these align with the organisation's data restoration timelines and procedures.
Good evidence
Contract will have clear service level agreements (SLAs) that match organisational needs.
- Check 5 of 5What an auditor asks for
Ask for
Meeting notes from twice-yearly reviews of the data restoration plan: Look to see if updates were discussed and made in response to changes in the organisation or technology. Good evidence will show continuous improvement and adaptation.
Mappings
Closest match in ISO/IEC 27001: A.5.30, ICT readiness for business continuity, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.30.
ISM-1548 requires organisations to develop, implement and maintain data restoration processes and supporting procedures. Annex A 5.30 supports ISM-1548 by requiring ICT readiness for business continuity be planned, maintained and tested, of which data restoration is a core capability.
This control partially overlaps A.8.13.
ISM-1548 requires organisations to develop, implement and maintain data restoration processes and supporting procedures. Annex A 8.13 relates by requiring backup copies be maintained and regularly tested, which directly supports effective restoration and provides inputs and assurance for restoration procedures.
ASD Essential Eight: 4 mappings
- E8-RB-ML1.2Ensure backups are synchronised for restoration to a common point in timePartially overlaps
This control partially overlaps E8-RB-ML1.2.
ISM-1548 requires organisations to develop, implement and maintain data restoration processes and supporting procedures. E8-RB-ML1.2 relates by requiring backups be synchronised so restoration can occur to a common point in time, which is a specific design requirement that restoration procedures must account for.
This control supports E8-RB-ML1.4.
E8-RB-ML1.4 requires organisations to test restoring data, applications, and settings from backups to a common point in time during disaster recovery exercises. ISM-1548 demands the development and maintenance of restoration processes, which are foundational for E8-RB-ML1.4 testing.
This control depends on E8-RB-ML1.1.
ISM-1548 requires organisations to develop, implement and maintain data restoration processes and supporting procedures. E8-RB-ML1.1 supports ISM-1548 by ensuring backups are performed and retained in line with business criticality and business continuity needs, which determines what restoration is possible and within what timeframes.
This control depends on E8-RB-ML1.3.
ISM-1548 requires organisations to develop, implement and maintain data restoration processes and supporting procedures. E8-RB-ML1.3 supports ISM-1548 by requiring backups be retained securely and resiliently, which increases the likelihood restoration processes can be executed during incidents such as ransomware.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-10.3Regularly test backup and restoration procedures against defined recovery objectivesPartially overlaps
This control partially overlaps IT.PRO-10.3.
IT.PRO-10.3 requires regular testing of backup and restoration procedures against recovery time and recovery point objectives; ISM-1548 requires data restoration processes and procedures to be developed, implemented and maintained, the procedures such testing exercises.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.