ASD ISM 1811 Secure and resilient data backup retention
What it says
Backups of data, applications and settings are retained in a secure and resilient manner.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure backups of data and applications are stored safely and can withstand issues.
Making sure data backups are safe and can handle unexpected problems is crucial for any organisation. If these backups aren't secure or can't be relied upon when needed, you risk losing important information due to system failures, cyber attacks, or even natural disasters.
Free. Save your status, tasks and notes.
Why it matters
Inadequate backup retention increases risk of data loss after ransomware, system failure or disaster, causing extended outages and costly recovery.
How to implement
IT team should regularly schedule backups: Designate a specific person or team in your IT department to create a backup schedule that includes daily, weekly, and monthly backups.
Use software solutions or automated tools to ensure these backups happen consistently without manual intervention.
System owners should store backups safely: Ensure that backups are stored in a secure location, separate from the original data.
Use external hard drives, cloud storage, or off-site servers to protect backups from being compromised in a single event, like a fire or flood.
IT team should test backup restoration: Regularly test the backup restoration process to ensure that data can be retrieved in a usable state when needed.
Run these tests after each major software update or at least quarterly, documenting any issues and resolutions.
Managers should implement access controls: Limit who can access and alter backup data to a minimum number of personnel.
Use passwords or other forms of authentication to secure access and set permissions based on roles.
Office managers should train staff about backup procedures: Educate employees about the importance of backups and how to report any anomalies.
Use easy-to-understand guidelines and visuals to demonstrate the backup process and highlight what's expected from everyone in case of an incident.
Keep it running
Define retention periods and immutable/offsite copies; encrypt and access-control backups; regularly test restores and review retention as systems change.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The backup schedule documentation: Request the backup timeline and frequency as recorded by the IT team.
Look at
These documents to ensure backups are scheduled and performed regularly.
Good evidence
Is a detailed schedule showing frequent and consistent backup intervals.
- Check 2 of 5What an auditor asks for
Ask for
To see the backup storage security measures: Request a walkthrough or description of where backups are stored, including physical and virtual safeguards.
Look at
Storage that is separate from main data locations and includes measures like encryption.
Good evidence
Shows proper physical and logical protections in place.
- Check 3 of 5What an auditor asks for
Ask for
To review results of recent backup restoration tests: Request reports or feedback from the last set of backup restoration drills.
Look at
The success rate and any identified issues with restoration processes.
Good evidence
Outcome is confirmed successful restorations without data loss or corruption.
- Check 4 of 5What an auditor asks for
Ask for
About staff training records on backup procedures: Request any records of training sessions held for employees on the backup process.
Look at
Who attended the training and what content was covered.
Good evidence
Includes evidence of regular training involving key staff members.
- Check 5 of 5What an auditor asks for
Ask for
To see access control logs for backup locations: Request logs or records showing who has accessed the backup storage. Look over these logs to see if only authorised personnel had access.
Good evidence
Shows minimal and well-controlled access entries.
Mappings
Closest match in ASD Essential Eight: E8-RB-ML1.3, Backups retained securely and resiliently, which asks for the same thing.
ASD Essential Eight: 9 mappings
This control is equivalent to E8-RB-ML1.3.
ISM-1811 requires backups of data, applications and settings to be retained in a secure and resilient manner. E8-RB-ML1.3 states the same requirement with effectively identical scope and intent. Implementing E8-RB-ML1.3 would largely satisfy ISM-1811 (and vice versa), noting only that ISM guidance may provide additional implementation detail beyond the Essential Eight statement.
This control is broader than E8-RB-ML1.6.
E8-RB-ML1.6 requires that unprivileged accounts are prevented from modifying and deleting backups. ISM-1811 is broader, requiring backups to be retained in a secure and resilient manner, which typically includes access controls, immutability and protected storage. E8-RB-ML1.6 maps as a specific access-control mechanism that contributes to meeting ISM-1811's broader retention and resilience outcome.
This control is broader than E8-RB-ML2.2.
E8-RB-ML2.2 requires that privileged accounts (excluding backup administrator accounts) cannot modify or delete backups. ISM-1811 requires backups to be retained in a secure and resilient manner, a broader outcome that typically includes controls like immutability, protected storage, and recovery resilience. E8-RB-ML2.2 is one specific access-control safeguard that helps achieve ISM-1811's wider secure-retention requirement.
This control is broader than E8-RB-ML3.1.
E8-RB-ML3.1 requires that unprivileged accounts cannot access their own backups. ISM-1811 is broader, requiring backups to be retained in a secure and resilient manner, which typically includes restricting access to backup data and systems. E8-RB-ML3.1 is one specific access-control measure that contributes to meeting ISM-1811, but does not address retention, resilience, or broader backup governance.
This control is broader than E8-RB-ML3.2.
E8-RB-ML3.2 mandates that privileged accounts (excluding backup administrator accounts) cannot access their own backups. ISM-1811 requires backup data to be retained securely and resiliently, including access restrictions and secure storage practices that reinforce the separation E8-RB-ML3.2 implies. Although ISM-1811 does not explicitly mandate this separation, it strengthens the backup security posture required to implement E8-RB-ML3.2 effectively.
This control is broader than E8-RB-ML3.3.
ISM-1811 requires backups to be retained securely and resiliently, which includes protecting them from tampering and deletion during the retention window. E8-RB-ML3.3 relates by mandating a specific protection mechanism: preventing backup administrators from modifying or deleting backups during their retention period. E8-RB-ML3.3 is one concrete subset control that helps achieve secure, resilient retention, while ISM-1811 encompasses additional resilience measures (for example, storage hardening and survivability) beyond administrator deletion protections.
This control partially meets E8-RB-ML1.1.
E8-RB-ML1.1 covers backups performed and retained according to business continuity needs. While ISM-1811 focuses on secure and resilient backup retention, E8-RB-ML1.1 encompasses broader business-driven alignment, covering overall backup strategy not limited to retention security.
- E8-RB-ML1.2Ensure backups are synchronised for restoration to a common point in timePartially overlaps
This control partially overlaps E8-RB-ML1.2.
ISM-1811 requires backups to be retained securely and resiliently so they remain usable when needed. E8-RB-ML1.2 relates by requiring synchronisation of backups to enable restoration to a common point in time, which is a key resilience characteristic for recovery. ISM-1811 is broader about secure/resilient retention, while E8-RB-ML1.2 is specifically about consistency and recoverability across systems rather than retention security controls.
This control supports E8-RB-ML1.4.
E8-RB-ML1.4 requires organisations to test restoration from backups to a common point in time during disaster recovery exercises. ISM-1811 focuses on the secure and resilient retention of backups so they are available for the E8-RB-ML1.4 restoration test.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.