ASD ISM 1708 Prevent backup modifications during retention
What it says
Backup administrator accounts are prevented from modifying and deleting backups during their retention period.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBackup administrators cannot change or delete backups until the retention period ends.
This control means that once backups are created, no one is allowed to change or delete them until a certain amount of time has passed. This is important because if backups could be changed or erased too early, you might lose important data that you need to recover from disasters or unexpected problems.
Free. Save your status, tasks and notes.
Why it matters
Backup modifications during retention risk data loss, undermining recovery efforts post-incident and increasing operational and reputational damage.
How to implement
IT manager should create clear policies: The IT manager should develop and implement policies that specify how and when backups can be accessed and modified.
This can be done by creating a set of rules that are communicated clearly to all staff involved in backup processes.
Backup administrator should set up restrictions: The backup administrator should configure the backup systems to automatically block any modifications or deletions until after the retention period.
This might involve using built-in features of backup software that enforce this protection.
Business owner should engage with IT suppliers: The business owner should ensure that any outsourced IT services or cloud providers are aware of your retention policies and have controls in place to enforce them.
This could involve checking contracts and discussing how they implement retention protections.
Finance team should budget for storage: The finance team should allocate sufficient budget to ensure storage costs are covered for the set retention period.
This will involve forecasting the storage needs based on current usage and future growth.
HR should train staff: The HR team should organise training sessions for all employees involved in handling backups.
The training should cover the importance of the retention period and how they can help maintain these policies.
Keep it running
Implement immutability for backups to prevent changes. Scheduled audits ensure backup integrity and the effectiveness of role-based restrictions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The backup policy document: Request the official organisation policy document that explains how backups are managed, including the retention period.
Look at
How the retention periods are defined and ensure they are realistic and enforced by the terms.
Good evidence
Is a clearly written policy outlining retention times and prohibiting early deletion or modification.
- Check 2 of 5What an auditor asks for
Ask for
A demonstration of backup system settings: Request the backup administrator show the settings in the backup software that enforce retention periods.
Look at
The configuration screens that show locked settings for the retention period.
Good evidence
Is a system configuration that clearly prevents changes or deletions until after the designated period.
- Check 3 of 5What an auditor asks for
Ask for
Communication logs with IT suppliers: Request any logs or communications confirming that IT suppliers understand and enforce your backup retention policies.
Look at
Emails, meeting notes, or contracts that discuss these specific requirements.
Good evidence
Is documentation showing supplier acknowledgement and compliance with the retention policy.
- Check 4 of 5What an auditor asks for
Ask for
Storage invoices and budget forecasts: Request financial records showing budget allocations for backup storage that account for full retention periods.
Look at
The financial forecasts and invoices for consistency with the storage needs outlined by the policy.
Good evidence
Shows a match between budgeted funds and expected storage costs over retention periods.
- Check 5 of 5What an auditor asks for
Ask for
Staff training records: Request the training materials and attendance records for staff involved in the backup process.
Look at
Evidence that training programs include instruction on backup retention policies.
Good evidence
Includes detailed training programs with signed attendance sheets indicating who was trained and when.
Mappings
Closest match in ASD Essential Eight: E8-RB-ML3.3, Backup administrators cannot modify or delete backups during retention, which asks for the same thing.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-RB-ML3.3.
ISM-1708 requires that backup administrator accounts are prevented from modifying or deleting backups during their retention period. E8-RB-ML3.3 states the same restriction on backup administrator accounts for the duration of retention. The scope and intent align closely (immutability/WORM-style protection against admin tampering until retention expiry).
This control partially overlaps E8-RB-ML1.6.
E8-RB-ML1.6 requires that unprivileged accounts are prevented from modifying and deleting backups. ISM-1708 focuses on restricting backup administrator accounts from modifying or deleting backups during the retention period, protecting against insider and ransomware-style abuse via admin paths. Both protect backup immutability, but ISM-1708 is retention-period and admin-role specific, whereas E8-RB-ML1.6 is about unprivileged accounts generally.
This control partially overlaps E8-RB-ML2.2.
E8-RB-ML2.2 requires that privileged accounts (excluding backup administrator accounts) cannot modify or delete backups. ISM-1708 instead restricts backup administrator accounts from modifying or deleting backups during the retention period, addressing a different actor while still aiming to protect backup integrity. Both reduce the risk of backup tampering, but E8-RB-ML2.2 does not constrain backup admins and ISM-1708 is specifically time-bound to retention.
This control partially overlaps E8-RB-ML3.2.
ISM-1708 requires that backup administrator accounts are prevented from modifying or deleting backups during their retention period. E8-RB-ML3.2 prevents privileged accounts (excluding backup administrators) from accessing their own backups, which reduces opportunities for privileged users to locate and influence backup content or processes. This is complementary to ISM-1708, but it does not address backup administrators' ability to modify/delete backups during retention.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.