# job 04 · backups you have tested
Backups you have tested, on a VPS you run
On a server you run, the backups have to survive whoever gets into that server, and the ISM, September 2026, says why: “malicious actors routinely seek to access backup infrastructure using credentials harvested from production environments”. Its backup section includes two controls at revision 0, dated September 2026: backups that can’t be changed or deleted during their retention period, and backup systems kept apart from the systems they protect, with their own sign-in for administrators.
General information, not technical advice for your server. This guide rests on the “Data backup and restoration” section of the ISM, September 2026: Guidelines for system management; the official place to check is cyber.gov.au.
whyWhy the backup is a target too
The ISM frames backups as a defence against ransomware and other destructive attacks: performed and kept in line with how critical the system is to the business, so that data is not lost and systems can be restored quickly.
Read for a server you run: the production environment is that server, so most of what follows is about keeping backups out of reach of its own logins.
ism: sep-26Two backup controls dated September 2026
ISM-2151Revision 0 · Updated Sep-26
“Backups are stored using a technically enforced immutability mechanism that prevents their modification or deletion for the duration of their retention period.”
In plain words: until a backup’s keeping period ends, nothing, including an administrator, can change or delete it, and that is enforced by the technology rather than by a rule people follow.
ISM-2152Revision 0 · Updated Sep-26
“Backup infrastructure, including backup servers, repositories and management consoles, is segregated from production environments and uses a separate authentication mechanism for administrative access.”
In plain words: the place the backups live is kept apart from the server they copy, and getting into it as an administrator uses a different way of signing in.
accessWho can touch the backups
The ISM asks that backups be protected from accidental or malicious change or deletion by access controls throughout their retention period. Its controls step up account by account. Each one below is quoted, with the Essential Eight maturity levels the ISM marks it for.
| Control | The control | Essential Eight |
|---|---|---|
| ISM-1814 | “Unprivileged user accounts are prevented from modifying and deleting backups.” | ML1, ML2, ML3 |
| ISM-1707 | “Privileged user accounts (excluding backup administrator accounts) are prevented from modifying and deleting backups.” | ML2, ML3 |
| ISM-1708 | “Backup administrator accounts are prevented from modifying and deleting backups during their retention period.” | ML3 |
| ISM-1705 | “Privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user accounts.” | ML2, ML3 |
Read together: at Maturity Level Two only backup administrator accounts can still change or delete backups, and at Maturity Level Three not even they can during the retention period. ISM-2152 adds a separate sign-in for the backup infrastructure itself.
restoreTesting the restore
ISM-1515 is the control behind this guide’s name: “Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises.” The ISM gives two reasons for testing: to make sure backups can be restored when the need arises, and to find and manage any dependencies beforehand.
“A common point in time” means data, applications and settings all come back from the same moment. The ISM asks that backups of data, applications and settings be “synchronised to enable restoration to a common point in time”, and that all of them be kept “in a secure and resilient manner”.
processWrite the process down
The ISM calls backup and restoration processes and procedures “an important part of business continuity and disaster recovery planning”, and two of its controls ask that both be developed, implemented and maintained:
- ISM-1547: “Data backup processes, and supporting data backup procedures, are developed, implemented and maintained.”
- ISM-1548: “Data restoration processes, and supporting data restoration procedures, are developed, implemented and maintained.”
For a business whose server runs its website, ASD’s small business handbook puts it simply. Among its steps to protect a website: “back up your website regularly so it can be restored after an incident.”