ASD ISM 1706 Prevent backup access by privileged users
What it says
Privileged user accounts (excluding backup administrator accounts) cannot access their own backups.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPrivileged users cannot access their own data backups; only backup administrators can.
This control means that people with special access, known as privileged users, should not be able to look at or retrieve data from their own backup files. This matters because if someone has bad intentions, they could misuse this access to manipulate data or hide certain changes, which could harm your business's integrity and trust.
Free. Save your status, tasks and notes.
Why it matters
If privileged users can access their own backups, they can alter or delete evidence, conceal misuse and compromise integrity, auditability and compliance.
How to implement
The IT manager should ensure that only designated backup administrators have the right to access backup files.
This can be done by setting up specific user permissions in the backup system, ensuring privileged users cannot see or access their own backup data.
The HR department should clearly define roles, including backup administrator roles, in job descriptions and duties.
Make sure there is a clear distinction between regular user roles and special backup administrator roles so lines are not blurred.
System administrators should conduct regular access reviews to ensure that only backup administrators have access to backups.
This involves using the backup system's access log features to review who has rights to what, adjusting permissions where necessary.
During employee onboarding or role changes, the IT team should verify that backup access rights align with their current job roles.
This means double-checking that former backup administrators or privileged users do not retain access after changing roles.
An external security consultant could be brought in periodically to audit backup access configurations.
This ensures an impartial overview and helps identify any unauthorised access or potential loopholes in the current setup.
Keep it running
Enforce access controls so only backup administrator accounts can read/restore backups; routinely review ACLs and logs to detect and fix any privileged-user access.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A copy of the access permissions configuration for the backup system.
Look at
Who currently has access to backup data files.
Good evidence
Is seeing only designated backup administrators listed with these permissions.
- Check 2 of 5What an auditor asks for
Look at
Any entries showing non-administrative users trying to access backup data.
Good evidence
Is that failed access attempts are logged and investigated.
- Check 3 of 5What an auditor asks for
Ask for
A record of any adjustments made to backup access permissions in the last 12 months.
Look at
Changes initiated with documented reasons and approvals.
Good evidence
Is a clean, traceable history of access adjustments.
- Check 4 of 5What an auditor asks for
Look at
How backup administrator roles are defined and separated from regular user roles.
Good evidence
Is a clear distinction in roles and responsibilities.
- Check 5 of 5What an auditor asks for
Ask for
Records of any security audits done on backup systems.
Look at
Documented findings and remedial actions taken regarding backup access.
Good evidence
Is regular audits with evidence of continual improvement and compliance.
Mappings
Closest match in ASD Essential Eight: E8-RB-ML3.2, Privileged user accounts cannot access their own backups, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.3.
Annex A 5.3 requires segregation of conflicting duties to reduce the risk of misuse and cover-up by a single individual. ISM-1706 relates by preventing privileged user accounts from accessing their own backups (except backup administrators), reducing the ability to tamper with or recover sensitive data in a way that bypasses oversight. ISM-1706 is a specific technical enforcement in the backup domain, while Annex A 5.3 is broader and covers segregation across all business processes and systems.
This control partially overlaps A.8.2.
Annex A 8.2 requires privileged access rights to be restricted and managed to prevent misuse of elevated permissions. ISM-1706 relates by limiting what privileged user accounts can do with backups, specifically preventing access to their own backups (except backup administrators), which constrains a sensitive privileged capability. ISM-1706 is a narrow control focused on backup access restrictions, while Annex A 8.2 covers privileged access rights across all resources and administrative activities.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-RB-ML3.2.
E8-RB-ML3.2 requires that privileged accounts (other than backup administrator accounts) are unable to access their own backups. ISM-1706 states the same requirement: privileged user accounts (excluding backup administrator accounts) cannot access their own backups. Both controls align in intent (preventing self-access to backup data by privileged users), scope, and exception handling, making implementation of one largely satisfy the other.
This control partially overlaps E8-RB-ML2.1.
ISM-1706 requires that privileged user accounts (excluding backup administrator accounts) cannot access their own backups. E8-RB-ML2.1 restricts privileged accounts from accessing backups belonging to other accounts, which is a related backup access segregation concept. The candidate is about preventing cross-user backup access, while ISM-1706 is specifically about preventing self-access, so each covers a different misuse scenario.
This control partially overlaps E8-RB-ML2.2.
ISM-1706 requires that privileged user accounts (excluding backup administrator accounts) cannot access their own backups. E8-RB-ML2.2 prevents privileged accounts from modifying or deleting backups, which addresses integrity and anti-ransomware objectives for backup stores. Both constrain what privileged users can do with backups, but ISM-1706 targets confidentiality/unauthorised reading of one's own backups whereas E8-RB-ML2.2 targets tampering and deletion.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.