Module 6 of StartCloud's Essential Eight for Australian Business learning pathway, in five short units with a knowledge check: what ASD's regular backups control actually asks for (data, software and settings, retained to suit business continuity, restoration tested, access restricted), why attackers deal with backups first and how ASD's Maturity Level Two and Level Three descriptions explain it, what a tested restore means to an assessor as opposed to a green tick in a dashboard, and why holding admin rights should not automatically grant access to the backups.
Backups You Can Actually Restore
The control nobody can bluff
Regular backups is the last of ASD's eight controls, and it is the odd one out. The other seven are about stopping bad things happening. This one exists for the day when all of that failed anyway, which is a humbling thing for a security framework to admit and the reason the framework is any good.
It is also the only control you cannot talk your way through. Patching can be described. Admin privileges can be summarised. Backups end with someone saying "show me", and either a file comes back or it does not.
Backups of the data, the software and the settings your business needs to keep running. Kept for as long as your continuity needs require. Restoration tested rather than assumed. And access to those backups restricted, so the people and accounts that can reach them are few and deliberate.
A backup product with a green tick, bought some years ago, never restored from. Data covered, settings and software not. Reachable by the same admin account that does everything else. Nobody has checked what is inside it since the day it was configured.
People hear "backups" and think documents. The control is broader on purpose. If a ransomware attack takes out your systems, restoring the files is only part of getting trading again. You also need the software and the configuration that made those files useful, the settings on the server, the way the line of business application was set up. Businesses that only backed up data find that out during the worst week of their year.