Regular backups
Back up important data, software and settings to business-continuity requirements, test restoration, and protect backups from change and deletion. The tables list the ISM controls ASD tags for this strategy at each maturity level; a level is reached only when every requirement at that level and below is met.
Patch applications · Patch operating systems · Multi-factor authentication · Restrict administrative privileges · Application control · Restrict Microsoft Office macros · User application hardening · Regular backups
Maturity Level One · 6 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-1511 | Backups of data, applications and settings are performed and retained in accordance with business criticality and business continuity requirements. | ML1, ML2, ML3 | A.8.13 A1.2 PR.DS-11 |
| ISM-1515 | Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises. | ML1, ML2, ML3 | A.5.30 A1.2 PR.DS-11 |
| ISM-1810 | Backups of data, applications and settings are synchronised to enable restoration to a common point in time. | ML1, ML2, ML3 | A.8.13 A1.2 PR.DS-11 |
| ISM-1811 | Backups of data, applications and settings are retained in a secure and resilient manner. | ML1, ML2, ML3 | A.8.13 A1.2 PR.DS-11 |
| ISM-1812 | Unprivileged user accounts cannot access backups belonging to other user accounts. | ML1, ML2, ML3 | — |
| ISM-1814 | Unprivileged user accounts are prevented from modifying and deleting backups. | ML1, ML2, ML3 | A.8.13 A1.2 PR.DS-11 |
Maturity Level Two · 8 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-1511 | Backups of data, applications and settings are performed and retained in accordance with business criticality and business continuity requirements. | ML1, ML2, ML3 | A.8.13 A1.2 PR.DS-11 |
| ISM-1515 | Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises. | ML1, ML2, ML3 | A.5.30 A1.2 PR.DS-11 |
| ISM-1705 | Privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user accounts. | ML2, ML3 | — |
| ISM-1707 | Privileged user accounts (excluding backup administrator accounts) are prevented from modifying and deleting backups. | ML2, ML3 | A.8.13 A1.2 PR.DS-11 |
| ISM-1810 | Backups of data, applications and settings are synchronised to enable restoration to a common point in time. | ML1, ML2, ML3 | A.8.13 A1.2 PR.DS-11 |
| ISM-1811 | Backups of data, applications and settings are retained in a secure and resilient manner. | ML1, ML2, ML3 | A.8.13 A1.2 PR.DS-11 |
| ISM-1812 | Unprivileged user accounts cannot access backups belonging to other user accounts. | ML1, ML2, ML3 | — |
| ISM-1814 | Unprivileged user accounts are prevented from modifying and deleting backups. | ML1, ML2, ML3 | A.8.13 A1.2 PR.DS-11 |
Maturity Level Three · 11 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-1511 | Backups of data, applications and settings are performed and retained in accordance with business criticality and business continuity requirements. | ML1, ML2, ML3 | A.8.13 A1.2 PR.DS-11 |
| ISM-1515 | Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises. | ML1, ML2, ML3 | A.5.30 A1.2 PR.DS-11 |
| ISM-1705 | Privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user accounts. | ML2, ML3 | — |
| ISM-1706 | Privileged user accounts (excluding backup administrator accounts) cannot access their own backups. | ML3 | — |
| ISM-1707 | Privileged user accounts (excluding backup administrator accounts) are prevented from modifying and deleting backups. | ML2, ML3 | A.8.13 A1.2 PR.DS-11 |
| ISM-1708 | Backup administrator accounts are prevented from modifying and deleting backups during their retention period. | ML3 | — |
| ISM-1810 | Backups of data, applications and settings are synchronised to enable restoration to a common point in time. | ML1, ML2, ML3 | A.8.13 A1.2 PR.DS-11 |
| ISM-1811 | Backups of data, applications and settings are retained in a secure and resilient manner. | ML1, ML2, ML3 | A.8.13 A1.2 PR.DS-11 |
| ISM-1812 | Unprivileged user accounts cannot access backups belonging to other user accounts. | ML1, ML2, ML3 | — |
| ISM-1813 | Unprivileged user accounts cannot access their own backups. | ML3 | — |
| ISM-1814 | Unprivileged user accounts are prevented from modifying and deleting backups. | ML1, ML2, ML3 | A.8.13 A1.2 PR.DS-11 |
Applies to every strategy
Logging and incident controls that ASD repeats under each strategy.
ML2: ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906
ML3: ISM-0109 ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906 ISM-1907
Control text: Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0. Links to other frameworks are ControlMapping editorial (ASD publishes no crosswalk). Essential Eight guide · Gap analysis → Essential Eight