ASD ISM 1814 Prevent backup modifications by unprivileged users
What it says
Unprivileged user accounts are prevented from modifying and deleting backups.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly authorised users can change or delete backups, keeping data safe from unauthorised access.
This control ensures that only authorised people can make changes to or delete backups of important data. This matters because if backups are tampered with or deleted by mistake or maliciously, you could lose critical data permanently, which can disrupt your business and cost you money.
Free. Save your status, tasks and notes.
Why it matters
If unprivileged users can alter or delete backups, attackers can erase recovery points, causing permanent data loss and outages.
How to implement
The IT team should set up user permissions so that only specific, trusted employees can access and modify backups.
They can do this by using software tools that let them assign roles and permissions, ensuring that regular employees don't have access to change or delete backups.
Business owners should decide who should have the authority to change backups.
They should work with their IT team to make sure this list is kept up-to-date and that the chosen employees understand their responsibilities.
System administrators should regularly review who has access to backup systems.
They should use access logs to check that only those with the right permissions are using the backup systems, and immediately remove access for anyone who no longer needs it.
Office managers should create a data handling policy that includes a section on backup management.
This policy should be shared with all staff to clarify who can manage backups and why protecting them is crucial.
The IT support team should install software that alerts them when someone tries to access backups without the right permissions.
This can include setting up email alerts or dashboard notifications to quickly respond to any unauthorised attempts.
Keep it running
Restrict backup repositories to backup admins only; use immutable/WORM storage, MFA, and regularly audit delete/modify permissions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of user access permissions for backup systems.
Look at
Whether permissions match the roles responsible for managing backups.
Good evidence
Only authorised personnel have permissions to modify or delete backups.
- Check 2 of 5What an auditor asks for
Look at
The process for granting and reviewing permissions to the backup systems.
Good evidence
A clear, documented process with regular reviews and updates.
- Check 3 of 5What an auditor asks for
Ask for
Records of access logs to the backup systems.
Look at
Instances where access was attempted or changes were made.
Good evidence
All access logs show only authorised users accessing the backup systems as expected.
- Check 4 of 5What an auditor asks for
Look at
Training records or attendance logs.
Good evidence
All staff involved in backup management have completed relevant training sessions.
- Check 5 of 5What an auditor asks for
Ask for
A recent alert log from the backup system.
Look at
The details of any unauthorised access attempts and the response actions taken.
Good evidence
Alerts were generated for unauthorised attempts, and prompt responses were logged.
Mappings
Closest match in ASD Essential Eight: E8-RB-ML1.6, Prevent unprivileged user accounts from modifying and deleting backups, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.3.
ISM-1814 requires that unprivileged user accounts are prevented from modifying and deleting backups. ISO/IEC 27001:2022 Annex A 8.3 requires restricting access to information and assets in line with access control policy, which includes controlling write/delete permissions to backup repositories. ISM-1814 is a specific application of access restriction focused on backups and unprivileged users, while Annex A 8.3 is broader across all information assets and access types.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-RB-ML1.6.
E8-RB-ML1.6 requires that unprivileged accounts are prevented from modifying and deleting backups. ISM-1814 states the same requirement using effectively identical scope and intent for access controls on backups. Implementing ISM-1814 would largely satisfy E8-RB-ML1.6 for this specific outcome.
This control partially overlaps E8-RB-ML2.2.
E8-RB-ML2.2 requires controls that prevent privileged accounts (except backup administrators) from modifying or deleting backups. ISM-1814 prevents unprivileged users from modifying or deleting backups, which complements the same integrity goal but for a different user class. Together they harden backup protection across privilege levels, but neither control fully covers the other's targeted actor set.
This control partially overlaps E8-RB-ML3.3.
E8-RB-ML3.3 requires that backup administrator accounts cannot modify or delete backups during their retention period. ISM-1814 also prevents modification/deletion of backups, but for unprivileged user accounts rather than backup administrators. The controls overlap in protecting backup integrity, but differ in threat model and scope (backup admins versus unprivileged users) and E8-RB-ML3.3 is retention-period specific.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.