cm/controlmapping
Sources
Essential Eight · Regular backups
ISM-1705

Privileged user accounts (excluding backup administrator accounts) cannot access…

frameworkASD Essential Eight sectionRegular backups levelsML2, ML3 csf 2.0PR.DS-11 RC.RP-03 topics— frameworks0 0 11 2
Official textPrivileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user accounts.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0
gap from Essential Eight → gap to Essential Eight →

Wrong or missing mapping? Report it

Equivalents of ISM-1705 in other frameworks
FrameworkRequirementTitleLinkSource / reason
NIST CSF 2.0PR.DS-11RC.RP-03Backups of data are created, protected, maintained, and tested; The integrity of backups and other restoration assets is verified before using them for restorationLoosely relatedNo mapping. Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
ISO 27001A.8.13Information backupLoosely relatedNo mapping. Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
CIS v8.1CIS 11.4CIS 11.5CIS 11.2CIS 11.3Establish and Maintain an Isolated Instance of Recovery Data; Test Data Recovery…Loosely relatedNo mapping. Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
SOC 2A1.2Environmental protections, backups and recovery infrastructureLoosely relatedNo mapping. Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
PCI DSS9.4.1.19.4.1.212.10.15.3.2Offline backup media stored securely; Security of offline backup location reviewed annually…Loosely relatedNo mapping. Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
+2 more loosely related (not mappings)
9.3.1.1 Sensitive-area access authorised and revoked promptly Loosely related
Only shares CSF PR.DS-11: related, not a mapping
9.4.7 Electronic media destroyed or made unrecoverable Loosely related
Only shares CSF PR.DS-11: related, not a mapping
CMMCMP.L2-3.8.9Protect BackupsLoosely relatedNo mapping. Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
800-53CP-9CP-2CP-4CP-6System Backup; Contingency Plan…Loosely relatedNo mapping. Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
HIPAA§164.308(a)(7)(ii)(A)§164.308(a)(7)(ii)(B)§164.310(a)(2)(i)§164.310(d)(2)(iv)Data Backup Plan; Disaster Recovery Plan…Loosely relatedNo mapping. Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
+6 more loosely related (not mappings)
§164.312(c) Integrity Loosely related
Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
§164.308(a)(7) Contingency Plan Loosely related
Only shares CSF RC.RP-03: related, not a mapping
§164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Loosely related
Only shares CSF RC.RP-03: related, not a mapping
§164.308(a)(7)(ii)(D) Testing and Revision Procedure Loosely related
Only shares CSF RC.RP-03: related, not a mapping
…and 2 more in the downloads
GDPRArt.32(1)(c)Security of processingLoosely relatedNo mapping. Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
NIS24.2Backup managementLoosely relatedNo mapping. Only shares CSF PR.DS-11: related, not a mapping
DORAArt.12(1)Art.12(2)Art.12(3)Backup policies and procedures, restoration and recovery procedures and methods; Backup policies and procedures, restoration and recovery procedures and methods…Loosely relatedNo mapping. Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
CPS 234—No requirementNo mapping in our dataNo mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials—No requirementNo mapping in our dataNo mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.