ASD ISM 1810 Ensuring data backup synchronisation
What it says
Backups of data, applications and settings are synchronised to enable restoration to a common point in time.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBackups should be in sync to restore everything to the same time point when needed.
This control is about making sure your organisation's data backups happen at the same time, so if you ever need to restore your data, everything comes back together just as it was on a certain day and time. It's important because if backups aren't synced, you might end up with a mishmash of old and new data, which can cause confusion or even lead to data loss.
Free. Save your status, tasks and notes.
Why it matters
Without synchronised backups, restoring systems can leave data and configurations out of step, causing inconsistencies and disrupting operations.
How to implement
The IT team should set up automated backup processes.
Use software that supports scheduled backups to ensure data, applications, and settings are backed up simultaneously. This way, you don't have to remember to do it manually, and it reduces the chance of making mistakes.
Managers should verify that the backup system covers all critical systems.
Create a list of crucial applications and data and ensure each is included in the backup plan. Regularly review this list to accommodate any changes in your organisation's operations.
The IT team should test the backup restoration process regularly.
Set a routine to restore data from backups in a test environment to ensure everything can be recovered correctly and the data is synchronised. This ensures you know the process works before a crisis occurs.
System owners should coordinate with the IT team to establish a backup frequency that meets business needs.
Discuss how often data changes to determine if daily, weekly, or another frequency will best protect your business. Document this decision for future reference.
Ensure stakeholders understand the backup policy.
The system owner should conduct a simple information session for staff, explaining the importance of data backup, what gets backed up, and how often, so everyone is on board and understands the process.
Keep it running
Confirm backup jobs complete in the same window for related systems, and run restore tests to validate point-in-time consistency.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The backup policy document: Request to see the written policy that outlines the backup strategy.
Look at
The backup schedule and the systems it covers.
Good evidence
Has complete documentation with clear details on timing and scope.
- Check 2 of 5What an auditor asks for
Ask for
The logs from the last backup operation.
Look at
Timestamps and system details to confirm they were simultaneous.
Good evidence
Result shows all components have consistent timestamps aligning with each other.
- Check 3 of 5What an auditor asks for
Ask for
To see the backup system in action.
Look at
The scheduling settings within the software used to ensure simultaneous backups. Good results show the software is configured to back up data, applications, and settings together.
- Check 4 of 5What an auditor asks for
Ask for
How the IT team tests backup restorations: Inquire about the process for testing backups.
Look at
Records of past test restorations, including dates and outcomes. It's good if tests occur regularly with notes proving successful data recovery.
- Check 5 of 5What an auditor asks for
Look at
Attendance records for any information sessions conducted.
Good evidence
Outcome shows regular training with documented participation.
Mappings
Closest match in ASD Essential Eight: E8-RB-ML1.2, Ensure backups are synchronised for restoration to a common point in time, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.13.
ISM-1810 requires backups of data, applications and settings to be synchronised so restoration can occur to a common point in time. Annex A 8.13 covers maintaining backups and regularly testing them under an agreed backup policy, which can include (but is not limited to) synchronisation requirements. ISM-1810 is a specific backup design requirement (point-in-time consistency), whereas Annex A 8.13 is broader across backup governance, operation and testing.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-RB-ML1.2.
ISM-1810 requires backups of data, applications and settings to be synchronised so restoration can occur to a common point in time. E8-RB-ML1.2 states the same requirement with the same restoration objective and scope across data, applications and settings. Implementing E8-RB-ML1.2 would largely satisfy ISM-1810 without needing additional interpretation.
This control partially overlaps E8-RB-ML1.3.
ISM-1810 requires synchronised backups to enable restoration to a common point in time across data, applications and settings. E8-RB-ML1.3 overlaps by focusing on retaining backups securely and resiliently, which helps ensure synchronised backups remain available and trustworthy for restoration. ISM-1810 is about consistency of backup points, while E8-RB-ML1.3 is about protection and resilience of the backup storage and retention approach.
This control supports E8-RB-ML1.4.
E8-RB-ML1.4 requires organisations to test restoring data, applications, and settings from backups to a common point in time during disaster recovery exercises. ISM-1810 requires backups to be synchronised so that restoration to a common point in time is possible, functioning as a prerequisite for E8-RB-ML1.4.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.