Backups are kept in a secure and resilient way (an isolated, offline or unchangeable copy), and ordinary staff accounts cannot change or delete them

Backups of data, applications and settings are retained in a secure and resilient manner. Required at Maturity Levels One, Two and Three of the Regular backups mitigation strategy (Appendices A, B and C); ISM control ISM-1811 in ASD's Essential Eight to ISM mapping (December 2023).

evidence an assessor asks for Evidence backups are stored securely and resiliently (offline, immutable or separate copies); Storage configuration

Unprivileged user accounts cannot access backups belonging to other user accounts. Required at Maturity Levels One, Two and Three of the Regular backups mitigation strategy (Appendices A, B and C); ISM control ISM-1812 in ASD's Essential Eight to ISM mapping (December 2023).

evidence an assessor asks for Backup repository permissions showing unprivileged accounts cannot reach other users' backups; Dated record of an assessor's attempt to defeat the setting, with the outcome

Unprivileged user accounts are prevented from modifying and deleting backups. Required at Maturity Levels One, Two and Three of the Regular backups mitigation strategy (Appendices A, B and C); ISM control ISM-1814 in ASD's Essential Eight to ISM mapping (December 2023). The Maturity Level Three table words it: "Unprivileged accounts are prevented from modifying and deleting backups."

evidence an assessor asks for Permissions preventing unprivileged accounts modifying or deleting backups; Dated record of an assessor's attempt to defeat the setting, with the outcome

Offline media backups that contain cardholder data must be kept in a secure location. The guidance describes off-site storage, for instance at a commercial storage provider or an alternate or backup site, as good practice, and notes that backups in a non-secured facility could be lost, stolen or copied. Applicability: entities keeping offline backups with cardholder data. Customized approach objective: unauthorized personnel cannot reach offline backups by unauthorized personnel.

evidence an assessor asks for Backup media storage procedure naming the secure storage location; Contract and security description for any commercial off-site storage vendor; Tape or disk check-in and check-out logs at the storage site; Access list for the backup storage room or vault

Give recovery data protection equal to that of the original data, drawing on encryption or data separation as the requirements dictate.

evidence an assessor asks for Backup encryption configuration showing the algorithm, key management arrangement and access restrictions on backup repositories; Access control list for backup storage and backup consoles, matched against the access list for the source data; Encryption settings for backup media and cloud backup storage, including tape encryption and key custody separate from backup operators; Data classification mapping showing backups of each sensitive data set protected at the same level as production; Access review of backup administrators and service accounts, with removals of staff who no longer need access

Set up and keep a copy of recovery data that is isolated, for example by version-controlling backup targets held off site, in the cloud or offline, whether as systems or as services.

evidence an assessor asks for Architecture or configuration record of the isolated backup copy: offline, immutable, air-gapped or versioned off-site or cloud target; Report confirming the isolated copy is current, with its retention and immutability settings and the date of the last successful write; Immutability or object lock configuration on the isolated backup target, with retention period and who can change it; Network and identity separation record showing the isolated copy is not reachable with production domain credentials; Off-site or offline media rotation log with dates, media IDs and custody signatures

Backups of data are created, protected, maintained, and tested. Control from NIST Cybersecurity Framework 2.0 framework, domain: PR - Protect.

evidence an assessor asks for Backup policy with frequency and retention; Backup integrity test reports; Immutable backup configuration evidence; Restoration test records with success criteria; Backup access control and audit logs

Offline media backups that contain cardholder data must be kept in a secure location. The guidance describes off-site storage, for instance at a commercial storage provider or an alternate or backup site, as good practice, and notes that backups in a non-secured facility could be lost, stolen or copied. Applicability: entities keeping offline backups with cardholder data. Customized approach objective: unauthorized personnel cannot reach offline backups by unauthorized personnel.

evidence an assessor asks for Backup media storage procedure naming the secure storage location; Contract and security description for any commercial off-site storage vendor; Tape or disk check-in and check-out logs at the storage site; Access list for the backup storage room or vault

Offline media backups that contain cardholder data must be kept in a secure location. The guidance describes off-site storage, for instance at a commercial storage provider or an alternate or backup site, as good practice, and notes that backups in a non-secured facility could be lost, stolen or copied. Applicability: entities keeping offline backups with cardholder data. Customized approach objective: unauthorized personnel cannot reach offline backups by unauthorized personnel.

evidence an assessor asks for Backup media storage procedure naming the secure storage location; Contract and security description for any commercial off-site storage vendor; Tape or disk check-in and check-out logs at the storage site; Access list for the backup storage room or vault

Backups of information, software and systems are to be kept and tested regularly as the agreed topic-specific backup policy requires. Purpose (stated in ISO/IEC 27002:2022): makes it possible to recover lost data or systems. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.13.

evidence an assessor asks for Statement of Applicability entry for control A.8.13, showing inclusion or justified exclusion, implementation status and the risks it treats; The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO; Backup job monitoring reports with evidence that failed jobs were investigated and rerun; Restore test records onto test systems, checked against the recovery time in the continuity plan; Evidence of off-site or geographically separate backup storage with suitable physical protection