ASD ISM 1813 Prevent unauthorised user access to backup data
What it says
Unprivileged user accounts cannot access their own backups.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that regular user accounts cannot view or restore their own backup files for security reasons.
This control ensures that regular users can't access, view, or restore the backup files of their own data. This matters because if anyone could see or modify their backups, it could lead to sensitive information being accidentally shared or altered, which could harm the entire organisation by making data unreliable or exposing it to competitors.
Free. Save your status, tasks and notes.
Why it matters
If unprivileged users can access their own backups, they could recover deleted data and exfiltrate sensitive information outside normal access controls.
How to implement
The IT team should set up access restrictions in the backup system so that only designated administrators can view and manage backup files.
They can do this by configuring user roles specifically in the backup software to prevent regular users from obtaining access.
System administrators need to implement a policy that clearly defines who can access backups and what actions they are permitted to perform.
This involves updating the company's existing security protocols and ensuring only administrators have backup access rights.
Managers should conduct training sessions to educate staff about why they cannot access their own backup files.
This can be done through regular meetings or informational emails explaining the security reasons behind these restrictions.
IT managers should regularly review the list of users with backup access to ensure compliance with policies.
This involves checking user roles and permissions in the backup system and revoking access that is no longer necessary.
The security team should set up alerts to notify them of any unauthorised access attempts to the backup system.
This can be achieved by configuring monitoring software to log access attempts and report unusual activities immediately.
Keep it running
Ensure backup repositories and restore tools are restricted to privileged roles; test that standard user accounts cannot list, read or restore their own backups.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The current backup access policy document: Ensure the document is up-to-date and specifies who has access and under what conditions.
Look at
Recent approval dates and signatures from management.
Good evidence
Includes a policy document with clear roles assigned and signed approval.
- Check 2 of 5What an auditor asks for
Look at
How many users have administrative access.
Good evidence
Should have a limited, justified number of users with backup permissions.
- Check 3 of 5What an auditor asks for
Ask for
A demonstration of user access restrictions in the backup system: Verify that only authorised users can access the backup files.
Look at
The user roles and permissions configured in the system.
Good evidence
Is a system setup where only specific admin roles can access backups.
- Check 4 of 5What an auditor asks for
Look at
Alerts and responses tied to unusual access attempts.
Good evidence
Shows no incidents of unauthorised access or a record of prompt responses to alerts.
- Check 5 of 5What an auditor asks for
Ask for
Staff training records regarding backup access policies: Verify that regular training sessions are conducted and that employees understand why they can't access their backups.
Look at
Attendance records and materials covered.
Good evidence
Includes complete training records with dated sessions and signed attendance.
Mappings
Closest match in ASD Essential Eight: E8-RB-ML3.1, Unprivileged user accounts cannot access their own backups, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
Annex A 5.15 requires rules and procedures to control logical access to information assets. ISM-1813 mandates a specific rule that unprivileged user accounts cannot access their own backups, restricting read access to backup data. The ISM control is a narrow access restriction for a particular asset class (backups), while Annex A 5.15 covers broader access control policy across all assets and access scenarios.
This control partially meets A.8.3.
ISM-1813 requires that unprivileged user accounts cannot access their own backup data. ISO/IEC 27001:2022 Annex A 8.3 requires restricting access to information and associated assets in accordance with an access control policy, which would include backup data as an information asset. ISM-1813 is a specific, backup-focused access restriction that fits within the broader access restriction requirement of Annex A 8.3.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-RB-ML3.1.
E8-RB-ML3.1 requires that unprivileged accounts cannot access their own backups. ISM-1813 states the same requirement: unprivileged user accounts cannot access their own backups. Both controls focus on preventing basic users from reaching backup repositories/copies of their own data, with effectively the same scope and intent.
This control partially overlaps E8-RB-ML1.5.
ISM-1813 requires that unprivileged user accounts cannot access their own backup data. E8-RB-ML1.5 extends the access restriction to unprivileged accounts being unable to access other users' backups, which is adjacent but not the same as self-backup access. The controls overlap in restricting unprivileged access to backups, but they differ in the ownership context (self vs others).
This control partially overlaps E8-RB-ML3.2.
ISM-1813 requires that unprivileged user accounts cannot access their own backup data. E8-RB-ML3.2 applies a similar principle to privileged accounts (excluding backup admins) by preventing them from accessing their own backups, addressing separation of duties and reducing insider risk. The overlap is the 'no self-access to backups' concept, but they differ by account class (unprivileged vs privileged).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.