---
title: "Essential Eight regular backups explained | CCP"
description: "Essential Eight regular backups: what Maturity Level 1, 2 and 3 require, who may change or delete backups, and how to test restores before you need one."
url: "https://ccp.com.au/essential-eight/regular-backups/"
datePublished: "2026-04-18"
dateModified: "2026-09-28"
author: "Computer Consultant Professionals"
---

# Essential Eight regular backups

## Backups an attacker can’t delete, and restores you’ve tested.

Regular backups are copies of your data, applications and settings, kept where an attacker can’t change them and restored in tests.

At a glance

Control

08 of 08 · Recover

Stops

Permanent data loss after ransomware or error

Typical tools

Immutable cloud backup, Microsoft 365 backup

Effort

Low to medium

Changing ASD is replacing the Essential Eight with a new Essentials series. The work you do now still counts. [What’s changing ](https://ccp.com.au/essential-eight/essentials-series/)

## What counts as regular backups?

### Where it stops an attack.

1.  The attack Ransomware encrypts your files, then goes looking for the backups.
3.  Stopped here The backups are kept where ordinary accounts, and at higher levels admin accounts, can’t change or delete them.
5.  The result You restore to a known point instead of paying.

## Essential 8 backup requirements

### What changes at each level.

What changes ML1 ML2 ML3

What’s backed up Data, apps and settings, by business criticality, to a common point in time No change No change

How they’re kept Securely and resiliently, for as long as the business needs No change No change

Restore testing Part of disaster recovery exercises No change No change

Staff accounts Can’t see others’ backups, or change or delete any No change Adds: can’t see their own

Admin accounts (not backup admins) Not required Can’t see others’ backups, or change or delete anyAdds: can’t see their own

Backup admin accounts Not required Not required Can’t change or delete backups during retention

Each level includes everything in the one before. A plain-English summary, not the requirement text. [ASD Essential Eight Maturity Model (November 2023)](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model)

[Check where you are with the free self-assessment](https://ccp.com.au/resources/essential-eight-checklist/)

## How to set up backups that survive ransomware

### Protection first, disruption last.

1.  01

    #### Decide what matters

    List critical systems and data, and how much loss and downtime you can live with.

2.  02

    #### Back up Microsoft 365 separately

    Microsoft keeps the service running. It doesn’t replace a backup of your mail, OneDrive and SharePoint.

3.  03

    #### Make backups immutable

    Keep copies off-site where they can’t be changed or deleted, even by an admin.

4.  04

    #### Test restores

    Restore real files and whole systems on a schedule, and time how long it takes.

[Related service: Backup and recovery](https://ccp.com.au/services/backup-recovery/)

## Common backup mistakes

### Where rollouts go wrong.

-   #### Never testing a restore

    The first test shouldn’t be during an incident.

-   #### Backups on the same network

    If ransomware can reach the backup, it encrypts that too.

-   #### Backup admin as just another admin

    One stolen account shouldn’t be able to delete everything.

## Regular backups questions

### What clients ask before we start.

### Doesn’t Microsoft back up our Microsoft 365 data?

Microsoft protects the service, not your data’s history. Retention is limited, and deletions by a compromised account sync everywhere. A separate backup is recommended.

### What is an immutable backup?

A backup copy that can’t be changed or deleted until its retention period ends, by anyone, administrators included.

### How often should we test backups?

ASD asks for restores to be tested as part of disaster recovery exercises. We recommend a restore test every quarter for critical systems.