ASD ISM 1705 Restrict access to user account backups
What it says
Privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user accounts.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly backup administrators can access backups; other privileged users cannot access backups of different accounts.
This control ensures that only backup administrators can access user account backups, meaning other staff with special access can't view or change these backups. This is important to prevent sensitive information from being misused or stolen by someone who shouldn't have access to it.
Free. Save your status, tasks and notes.
Why it matters
If privileged users can access other users' backups, sensitive data may be exposed and integrity and confidentiality compromised.
How to implement
System administrators should assign specific roles: Make sure there's a designated backup administrator role and only certain staff members have access to this role.
Use your system's user management features to clearly define and assign these roles.
IT managers should set strict access controls: Develop rules so that only backup administrators can view backups.
Implement this using your system's access settings, carefully assigning permissions based on roles.
Managers should conduct routine access audits: Regularly check who has access to backups to ensure there haven't been any unauthorised changes to permissions.
Use a simple spreadsheet to track changes and ensure compliance.
Backup administrators should receive special training: Provide clear guidelines and training to backup administrators on how to manage and protect backups.
Use workshops or online courses to ensure they understand their responsibilities.
The IT team should utilise software tools: Use security software to automatically log access to backups and flag any abnormalities.
Regularly review these logs to ensure only authorised individuals are accessing backups.
Keep it running
Regularly review backup ACLs so only backup administrator accounts can access other users' backups; log and alert on unauthorised access attempts.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The user access documentation: Request the list of roles and permissions showing who can access backups.
Look at
Whether only backup administrators have access to sensitive areas.
Good evidence
Is when only backup administrators are listed.
- Check 2 of 5What an auditor asks for
Ask for
The logs detailing who has accessed backups in the last month.
Look at
Timestamps and user IDs to verify only backup administrators accessed them.
Good evidence
Shows consistent recorded logins from authorised personnel only.
- Check 3 of 5What an auditor asks for
Ask for
Training records of backup admins: Request certificates or attendance sheets of specific training related to backup management.
Look at
Whether the names listed match current backup administrators.
Good evidence
Shows all current administrators have completed training.
- Check 4 of 5What an auditor asks for
Look at
Findings and actions taken as a result.
Good evidence
Includes clear records of audits and changes made to maintain correct access.
- Check 5 of 5What an auditor asks for
Ask for
A demonstration of access settings: Request a live demonstration showing how permissions are set in the system.
Look at
The roles and users listed for backup access.
Good evidence
Is one where only backup administrators are given permission.
Mappings
Closest match in ASD Essential Eight: E8-RB-ML2.1, Prevent privileged user accounts from accessing others' backups, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.3.
ISM-1705 requires that privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user accounts. Annex A 8.3 is broader, requiring access to information and associated assets to be restricted in line with an access control policy, which would include backups as an asset class. ISM-1705 is a specific, prescriptive access restriction for backups and privileged identities, representing a concrete subset of the general ISO requirement.
This control partially meets A.8.13.
Annex A 8.13 requires backups to be maintained and regularly tested so they can be relied upon for recovery. ISM-1705 restricts privileged user accounts (excluding backup administrators) from accessing other users' backups, reducing the risk of unauthorised access or interference that could undermine backup trustworthiness. This complements Annex A 8.13 by improving backup confidentiality and integrity controls, but it does not itself require maintaining or testing backups.
This control partially overlaps A.5.3.
Annex A 5.3 requires segregation of duties to prevent a single role from having conflicting capabilities that enable concealment or misuse. ISM-1705 relates by preventing privileged user accounts from accessing other users' backups (except backup administrators), separating system administration from backup data access. ISM-1705 is narrowly about backup access boundaries, while Annex A 5.3 also addresses broader conflicts such as administrators vs auditors or developers vs production operators.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-RB-ML2.1.
ISM-1705 requires that privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user accounts. E8-RB-ML2.1 states the same restriction for privileged accounts accessing others' backups, with the same carve-out for backup administrators. The scope and intent align closely: limiting backup read/access pathways to the backup administrator role.
This control partially overlaps E8-RB-ML2.2.
E8-RB-ML2.2 requires that privileged accounts (excluding backup administrator accounts) cannot modify or delete backups. ISM-1705 limits privileged accounts from accessing other users' backups, reducing the opportunity for those accounts to reach backup repositories in the first place. ISM-1705 is about access scoping (who can see which backups), while E8-RB-ML2.2 is about preventing destructive or altering actions even if access exists.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.