What counts as regular backups?
Where it stops an attack.
- The attack Ransomware encrypts your files, then goes looking for the backups.
- Stopped here The backups are kept where ordinary accounts, and at higher levels admin accounts, can’t change or delete them.
- The result You restore to a known point instead of paying.
Essential 8 backup requirements
What changes at each level.
What changes ML1 Maturity Level 1. ML2 Maturity Level 2. ML3 Maturity Level 3.
What’s backed up Data, apps and settings, by business criticality, to a common point in time No change
No change
How they’re kept Securely and resiliently, for as long as the business needs No change
No change
Restore testing Part of disaster recovery exercises No change
No change
Staff accounts Can’t see others’ backups, or change or delete any No change
Adds: can’t see their own
Admin accounts (not backup admins) Not required
Can’t see others’ backups, or change or delete anyAdds: can’t see their own
Backup admin accounts Not required
Not required
Can’t change or delete backups during retention
Each level includes everything in the one before. A plain-English summary, not the requirement text. ASD Essential Eight Maturity Model (November 2023)
How to set up backups that survive ransomware
Protection first, disruption last.
- 01
Decide what matters
List critical systems and data, and how much loss and downtime you can live with. - 02
Back up Microsoft 365 separately
Microsoft keeps the service running. It doesn’t replace a backup of your mail, OneDrive and SharePoint. - 03
Make backups immutable
Keep copies off-site where they can’t be changed or deleted, even by an admin. - 04
Test restores
Restore real files and whole systems on a schedule, and time how long it takes.
Common backup mistakes
Where rollouts go wrong.
-
Never testing a restore
The first test shouldn’t be during an incident.
-
Backups on the same network
If ransomware can reach the backup, it encrypts that too.
-
Backup admin as just another admin
One stolen account shouldn’t be able to delete everything.
Doesn’t Microsoft back up our Microsoft 365 data?
Microsoft protects the service, not your data’s history. Retention is limited, and deletions by a compromised account sync everywhere. A separate backup is recommended.
What is an immutable backup?
A backup copy that can’t be changed or deleted until its retention period ends, by anyone, administrators included.
How often should we test backups?
ASD asks for restores to be tested as part of disaster recovery exercises. We recommend a restore test every quarter for critical systems.