PRO-10 · Protect

Regular and proven backups

Systems (infrastructure, operating systems, applications and data) are regularly backed up in a secure and proven manner, including through the validation of restoration capabilities.

Enterprise IT actions

• IT.PRO-10.1

  Back up important data, applications and settings on a defined schedule to secure, resilient storage protected by encryption and immutable, offline, logically isolated or equivalent controls.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems
  ASD’s indicators

  Not effective

  • No managed backup process exists for important data, applications and settings.
  • Backup storage is neither encrypted nor protected by immutable, offline, logically isolated or equivalent controls.

  Partially effective

  • Important data, applications and settings are backed up, but backup schedules are not defined, do not cover all important assets, or are not consistently met.
  • Backups are encrypted but no immutable, offline, logically isolated or equivalent resilience controls are consistently applied.
  • Backups use immutable, offline, logically isolated or equivalent controls, but encryption is not consistently enforced.

  Fully effective

  • All important data, applications and settings are backed up according to schedules defined by the organisation and aligned with their recovery requirements.
  • Backup schedules are monitored, and missed or unsuccessful backups are identified, investigated and remediated within timeframes defined by the organisation.
  • Backup storage is encrypted and protected by immutable, offline, logically isolated or equivalent controls.
  Related frameworks

  ISM

  ISM-1547

  NIST CSF 2.0

  PR.DS-01, PR.DS-11, RC.RP-03

  NIST SP 800-171r3

  03.08.09, 03.13.11

  AESCSF v2

  RESPONSE-4b, RESPONSE-4j, ARCHITECTURE-5b

  Essential Eight

  Regular backups

  MITRE ATT&CK

  T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery

  Rate this action in the Navigator →
• IT.PRO-10.2

  Isolate backup repositories from general user environments and production workloads, ensuring they are separated from primary systems to prevent unauthorised access, modification or deletion.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems
  ASD’s indicators

  Not effective

  • Backup repositories are accessible from the production environment or by production administrators.
  • Compromise of a system would provide a direct path to access, modify or delete its own backups.

  Partially effective

  • Backup repositories are logically separated but use credentials managed by the same identity platform as production.
  • Isolation is implemented but has not been tested or validated.

  Fully effective

  • Backup repositories are isolated from production environments and general user access.
  • Access is controlled through credentials and administrative paths isolated from compromise of the primary identity environment.
  • Isolation has been validated to confirm that compromise of a system does not provide access to backups.
  Related frameworks

  NIST CSF 2.0

  PR.DS-01, PR.DS-11, PR.IR-01, PR.AA-05

  NIST SP 800-171r3

  03.08.09, 03.08.02, 03.01.02

  AESCSF v2

  RESPONSE-4k, RESPONSE-4j, ARCHITECTURE-2d

  Essential Eight

  Regular backups

  MITRE ATT&CK

  T1486 Data Encrypted for Impact, T1005 Data from Local System, T1490 Inhibit System Recovery

  Rate this action in the Navigator →
• IT.PRO-10.3

  Conduct regular testing of backup and restoration procedures to ensure that backups are reliable and capable of meeting defined recovery time objectives and recovery point objectives.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems
  ASD’s indicators

  Not effective

  • No restoration test has been conducted within the test cycle defined by the organisation.
  • No backup or restoration procedures exist.
  • Restoration testing demonstrates that backups cannot be restored, or consistently fail to meet defined recovery time or recovery point objectives.

  Partially effective

  • Restoration testing has been conducted but does not cover all important assets.
  • Backup procedures exist but have never been tested.
  • Testing has been conducted but coverage is incomplete or some tests did not meet the expected recovery time or recovery point objectives.

  Fully effective

  • Restoration testing covering important assets is conducted within the test cycle defined by the organisation.
  • Testing validates that restoration meets the expected recovery time and recovery point objectives.
  • Test results are documented and gaps identified during testing are remediated.
  Related frameworks

  ISM

  ISM-1548

  NIST CSF 2.0

  PR.DS-11, RC.RP-03, RC.RP-04, RC.RP-05

  NIST SP 800-171r3

  03.08.09, 03.06.03

  AESCSF v2

  RESPONSE-4b, RESPONSE-4f

  Essential Eight

  Regular backups

  MITRE ATT&CK

  T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery

  Rate this action in the Navigator →

Operational technology actions

• Action 1

  Conduct regular testing of rebuild, backup and restoration procedures to ensure that they are reliable and capable of meeting defined recovery time objectives and recovery point objectives, including rebuilding in the absence of backups.

  • Phase 1Boundary services, Critical processes and services
  • Phase 2Privileged environments, Identity services
  Rate this action in the Navigator →
• Action 2

  Backup the firmware, configuration, licence, calibration, project and logic files and supplier images required to rebuild OT, held per site and isolated from network access, on a defined schedule aligned to criticality and rate of change, and maintained to support restoration to a common point in time.

  • Phase 1Critical processes and services
  Rate this action in the Navigator →

Cloud actions

• Action 1

  Back up settings, identities, policies, integrations, tenant configurations, and other important data to immutable storage on a defined schedule, implementing customer-controlled backup where provider arrangements are insufficient.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →
• Action 2

  Isolate backup repositories from production cloud environments through separate accounts, subscriptions or tenants with independent access controls, preventing unauthorised modification or deletion.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →
• Action 3

  Conduct regular testing of backup data and restoration procedures to ensure that backups are reliable and capable of meeting defined recovery time objectives and recovery point objectives.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →
• Action 4

  Establish recovery arrangements with the service provider, covering data loss, malicious deletion and tenant misconfiguration.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →
• Action 5

  Vital cloud capabilities that require absolute availability for mission critical objectives are able to be quickly rebuilt on another provider if organisational needs demand.

  • Phase 2Critical processes and services, Privileged environments
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →

Open the Navigator →

More Protect principles

• PRO-01Secure system lifecycle
• PRO-04Secure configuration management
• PRO-05Secure administration
• PRO-06Vulnerability management
• PRO-07Trustworthy software
• PRO-08Cryptographic protection
• PRO-09Content filtering
• PRO-12Least privilege access
• PRO-13Identity, credential and access management
• PRO-14Cyber security awareness training
• PRO-15Physical access control
• PRO-16Cyber supply chain security
• PRO-18Network segmentation and segregation
• PRO-19Operational technology isolation
• PRO-20Remote access to operational technology

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.