ASD ISM 1812 Restrict backup access to unprivileged users
What it says
Unprivileged user accounts cannot access backups belonging to other user accounts.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that users without special permissions cannot see other people's backups.
This control makes sure that only users with the proper permissions can see or get into backup files of others. It's important because if someone without permission can access backups, they might see private information or alter important files without anyone knowing.
Free. Save your status, tasks and notes.
Why it matters
If unprivileged users can access other users' backups, confidential data may be disclosed and backup data could be altered, impacting integrity.
How to implement
IT team should review user permissions for backup systems.
First, list all users who have access to backup files. Then ensure only authorised personnel have the right permissions by checking and updating user accounts accordingly.
System administrators should set up role-based access controls.
Determine which staff need access to backup information and set permissions so only those roles can view or change backups. Use settings in your backup software to apply these controls.
Managers should communicate policies on data access.
Notify all staff about who is permitted to access backups and the reasons why restricting access is crucial for security. Regularly remind them through meetings or bulletins.
IT security teams should implement auditing and monitoring tools.
Set up alerts to track who accesses backups and investigate any unauthorised access attempts. Use logs to check the system regularly for suspicious activity.
HR and IT should work together on training sessions.
Educate staff about the importance of securing backups and recognising potential risks associated with unauthorised access. Make sure training is part of the regular professional development schedule.
Keep it running
Enforce per-user backup ACLs so unprivileged accounts can only view/restore their own backups; regularly audit access and test restore permissions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of current users with backup access.
Look at
The list to ensure only those with specific duties related to handling backups are included.
Good evidence
Shows only relevant IT or management roles listed, matching their job responsibilities.
- Check 2 of 5What an auditor asks for
Good evidence
Is a document that clearly defines access roles and is updated regularly.
- Check 3 of 5What an auditor asks for
Ask for
Recent access logs to backup files.
Look at
The logs for any access attempts that do not align with individuals' roles.
Good evidence
Shows that all entries match the access policy and roles.
- Check 4 of 5What an auditor asks for
Good evidence
Includes dated attendance records and summaries of what was covered in the sessions.
- Check 5 of 5What an auditor asks for
Good evidence
Includes logs of generated alerts and actionable steps taken following an alert.
Mappings
Closest match in ASD Essential Eight: E8-RB-ML1.5, Unprivileged user accounts cannot access others' backups, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.18.
ISM-1812 requires preventing unprivileged accounts from accessing other users' backups. Annex A 5.18 addresses the broader lifecycle of access rights (provisioning, review, modification and removal) for information and associated assets, which would be used to implement and maintain restrictions over backup access. ISM-1812 is narrower because it specifies one access-right outcome for backups rather than the full access-right management process.
This control partially meets A.8.3.
ISM-1812 requires a specific access restriction: unprivileged users must not be able to access backups belonging to other users. Annex A 8.3 requires that access to information and associated assets be restricted in line with an access control policy, which would include backups as information assets. ISM-1812 is a concrete, backup-specific instance of the broader access restriction principle in Annex A 8.3.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-RB-ML1.5.
ISM-1812 requires that unprivileged user accounts cannot access backups belonging to other user accounts. E8-RB-ML1.5 states the same requirement, explicitly preventing unprivileged accounts from accessing other accounts' backups. The scope and intent align closely, with both focused on preventing cross-user backup access by unprivileged users.
This control partially overlaps E8-RB-ML2.1.
ISM-1812 requires that unprivileged user accounts cannot access backups belonging to other user accounts. E8-RB-ML2.1 addresses access to others' backups as well, but focuses on restricting privileged accounts (excluding backup administrators) rather than unprivileged users. They overlap on the objective of preventing unauthorised cross-account access to backups, but each targets a different account class and threat path.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.