BACKUP-ML3 Regular Backups (ML3)
All ML2 requirements plus: Unprivileged user accounts cannot access their own backups. Privileged user accounts (excluding backup administrator accounts) cannot access their own backups. Backup administrator accounts are
8
artefacts
4
held by a system
2
at each review
easy
to go live
Backup / DR tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Backup platform configuration showing immutable retention (Veeam Hardened Repository, Rubrik SLA, Azure Immutable Vault, AWS S3 Object Lock Compliance mode) · Backup / DR tooling
- Privileged user backup self-access prevention configuration · Backup / DR tooling
- Audit log showing attempted modification or deletion of in-retention backups is rejected · Backup / DR tooling
- Backup retention configuration export with periods aligned to BCP requirements · Backup / DR tooling
periodic reviewEvidence produced at each review
- Evidence that backup administrators cannot delete or modify backups within retention period even with full admin rights · Backup / DR tooling
- Annual immutability test report · Identity provider / directory
governing documentDocuments that govern the control
- Policy and technical control showing unprivileged users cannot restore or read their own backups directly (must go through service desk) · Policy repository / GRC workspace
- Cryptographic verification (hashing, chain of custody) of backup integrity · Policy repository / GRC workspace
First move
Automate the pull from your Backup / DR tooling. Backup job success history and restore-test logs from the backup platform.
Common gaps auditors find
- Backup admin has implicit override (Compliance mode set to Governance mode, allowing override)
- User self-restore portal allows users to access their own backups
- Immutability implemented but retention period shorter than RPO+investigation window
- Cloud backup vault deletable by tenant root account (account-level controls missing)
- No annual test of immutability (no attempted delete from authoritative admin)
- Tamper-evident logging not enabled on the backup platform itself
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetBACKUP-ML2 Regular Backups (ML2) · MACRO-ML1 Configure Microsoft Office Macro Settings (ML1)