PRO-10 Regular and proven backups

five actionsAlso in ASD Essentials for enterprise IT

Back up important data and settings on a schedule to storage that cannot be changed, kept apart from your live environments. Test that you can restore in time. Agree recovery arrangements with your provider. Make sure capabilities that must always be available can be rebuilt quickly on another provider.

Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026

The principle

Systems (infrastructure, operating systems, applications and data) are regularly backed up in a secure and proven manner, including through the validation of restoration capabilities.

ASD, Information Security Manual (ISM), Principle PRO-10

The five actions

ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.

C: Customer
S: Supplied
P: Provider-inherited

Action 1 of 5
Backup important data and settings to immutable storage on a defined schedule, implementing customer-controlled backup where provider arrangements are insufficient.
In plain English: Back up important data and settings on a set schedule to immutable storage (which cannot be altered). Where provider arrangements are not enough, use backups you control.
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
Who does it
PaaSSupplied
SaaSSupplied
MITRE ATT&CK
Data Destruction
Data Encrypted for Impact
Inhibit System Recovery
Data Manipulation
Action 2 of 5
Isolate backup repositories from production cloud environments through separate accounts, subscriptions or tenants with independent access controls, preventing unauthorised modification or deletion.
In plain English: Isolate backups from live cloud environments in separate accounts, subscriptions or tenants (your own instances of a service) with independent access controls. This blocks unauthorised changes or deletion.
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
User devices
Who does it
PaaSCustomer
SaaSCustomer
MITRE ATT&CK
Data Encrypted for Impact
Data Destruction
Inhibit System Recovery
Data Manipulation
Action 3 of 5
Conduct regular testing of backup data and restoration procedures to ensure that backups are reliable and capable of meeting defined recovery time objectives and recovery point objectives.
In plain English: Regularly test backups and restore procedures. Check they are reliable and can meet your targets for how fast you recover and how much data you can lose.
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
Who does it
PaaSCustomer
SaaSCustomer
MITRE ATT&CK
Data Encrypted for Impact
Data Destruction
Inhibit System Recovery
Data Manipulation
Action 4 of 5
Set-up recovery arrangements with the service provider, covering data loss, malicious deletion and tenant misconfiguration.
In plain English: Set up recovery arrangements with the service provider. They should cover data loss, malicious deletion and wrong settings in your tenant.
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
Who does it
PaaSSupplied
SaaSSupplied
MITRE ATT&CK
Data Encrypted for Impact
Data Destruction
Inhibit System Recovery
Data Manipulation
Action 5 of 5
Vital cloud capabilities that require absolute availability for mission critical objectives are able to be quickly rebuilt on another provider if organisational needs demand.
In plain English: Some vital cloud capabilities must always be available for mission-critical objectives. Make sure these can be rebuilt quickly on another provider if your needs demand it.
Domains
Critical processes and services
Privileged environments
Who does it
PaaSSupplied
SaaSSupplied
MITRE ATT&CK
Data Destruction
Inhibit System Recovery
Service Stop