ASD ISM 1707 Restrict backup modifications by privileged users
What it says
Privileged user accounts (excluding backup administrator accounts) are prevented from modifying and deleting backups.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly backup admins can modify or delete backups; others are restricted.
This control ensures that only backup administrators can change or delete important backup files. It's like keeping the keys to a locked safe: if everyone has access, it's easy for someone to accidentally or intentionally delete essential files, which could lead to losing vital data or backups when they're needed most.
Free. Save your status, tasks and notes.
Why it matters
Without this control, privileged users could delete backups, risking permanent data loss and crippling business recovery efforts.
How to implement
The IT manager should designate specific individuals as backup administrators.
This involves formally assigning the role to responsible staff with the skills needed to manage backups securely.
Backup administrators should set up user accounts with special permissions just for handling backups.
This can be done by creating unique accounts for backup tasks that don't overlap with other duties.
The IT team should configure systems to restrict modification permissions on backups to only these designated accounts.
They can do this by adjusting file access controls or system settings to ensure only the backup accounts have these rights.
Training personnel on recognising why only specific people should alter backups should be done by the HR team.
This can be accomplished through regular workshops or informational sessions to explain the importance of this control.
Periodic reviews by the IT team should ensure these restrictions are still effective and necessary.
Set a schedule, perhaps quarterly, to check the list of authorised accounts and modify it as staff roles change.
Keep it running
Regularly audit backup admin permissions to prevent unauthorised privilege escalation and protect backup integrity.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of designated backup administrator accounts: Request the document or system setting that lists who has these roles.
Look at
Names, roles, and access dates.
Good evidence
A current and complete list matching personnel involved in backup tasks.
- Check 2 of 5What an auditor asks for
Ask for
System permissions settings: Request a report or screenshot showing access settings for backups.
Look at
Who can modify or delete backups.
Good evidence
Permissions granted only to backup administrators, with no excessive access to others.
- Check 3 of 5What an auditor asks for
Ask for
Role assignment documentation: Request HR or IT records showing how backup admin roles are assigned.
Look at
The criteria and approval process for selecting these individuals.
Good evidence
A documented and recent approval process with management approval.
- Check 4 of 5What an auditor asks for
Ask for
Training records: Request records of training sessions or materials given to staff.
Look at
Information specific to backup administration and role limitations.
Good evidence
Sessions held regularly, with attendance records and feedback.
- Check 5 of 5What an auditor asks for
Ask for
The audit schedule: Request a document detailing when and how access reviews are performed.
Look at
Dates of previous audits and planned future ones.
Good evidence
A well-documented schedule with evidence of past compliance checks.
Mappings
Closest match in ASD Essential Eight: E8-RB-ML2.2, Privileged user accounts cannot modify or delete backups, which asks for the same thing.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-RB-ML2.2.
E8-RB-ML2.2 requires that privileged accounts (except backup administrator accounts) are prevented from modifying or deleting backups. ISM-1707 states the same requirement with the same exception, directly aligning on both scope (privileged users) and protection objective (immutability/deletion prevention). Implementing ISM-1707 would largely satisfy E8-RB-ML2.2 for this backup protection outcome.
This control partially overlaps E8-RB-ML1.6.
E8-RB-ML1.6 requires that unprivileged accounts are prevented from modifying and deleting backups. ISM-1707 addresses a related but different actor group by preventing most privileged accounts (excluding backup administrators) from modifying and deleting backups, which strengthens overall backup integrity. The controls overlap on the objective of protecting backups from unauthorised change, but differ materially in scope (unprivileged vs privileged accounts).
This control partially overlaps E8-RB-ML3.3.
ISM-1707 focuses on preventing non-backup administrators from modifying/deleting backups, whereas E8-RB-ML3.3 constrains backup administrators from making changes during specified retention periods. They both aim to protect backup integrity but are applied to different roles, and E8-RB-ML3.3 includes retention-timing conditions not found in ISM-1707.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.