{"id":19830,"date":"2024-08-01T04:47:33","date_gmt":"2024-08-01T04:47:33","guid":{"rendered":"https:\/\/www.backupassist.com\/blog\/?p=19830"},"modified":"2026-04-03T13:24:08","modified_gmt":"2026-04-03T13:24:08","slug":"the-role-of-backups-in-cyber-security-frameworks-and-cyber-insurance-in-australia","status":"publish","type":"post","link":"https:\/\/www.backupassist.com\/blog\/the-role-of-backups-in-cyber-security-frameworks-and-cyber-insurance-in-australia","title":{"rendered":"The Role of Backups in Cyber Security Frameworks and Cyber Insurance in Australia"},"content":{"rendered":"\n

In today’s digital age, the significance of robust cyber security measures cannot be overstated. Cyber threats are evolving rapidly, and organizations must stay vigilant to protect their sensitive data and systems. Backups play a crucial role in any cyber security framework, offering a safety net in the event of data breaches, ransomware attacks, or other cyber incidents.<\/p>\n\n\n\n

In a recent technical webinar<\/a>, Wilson Nheu, CEO of BackupAssist, shed light on the role of backups in cyber security frameworks and cyber insurance in Australia. This blog delves into the key takeaways from the webinar.<\/p>\n\n\n\n

\n \n \n \n

\n \n <\/td>\n
\n Note:<\/b> While this article focuses on Australia\u2019s cyber security frameworks, it\u2019s worth noting that the US has the NIST framework<\/a>, which shares some similarities with the Essential 8 but also has distinct differences in its approach and scope.\n \n

\n <\/td>\n <\/tr>\n <\/tbody>\n <\/table>\n<\/figure>\n\n\n\n

Understanding the Essential 8<\/h2>\n\n\n\n

The Australian Signals Directorate’s (ASD) Australian Cyber Security Centre (ACSC) has developed the Essential 8<\/a>, a set of eight mitigation strategies to help organizations bolster their cyber security posture. These strategies are designed to protect against various cyber threats and are publicly available for free. The Essential 8 Maturity Model outlines four levels of maturity (0-3), with higher levels offering more comprehensive protection against complex cyber attacks.<\/p>\n\n\n\n

\"ACSC<\/a><\/figure><\/div>\n\n\n\n

While all eight strategies are vital, this blog focuses on the controls for regular backups<\/strong>, a cornerstone of any effective cyber security plan.<\/p>\n\n\n\n

Controls for Regular Backups<\/h2>\n\n\n\n

The ACSC outlines 11 specific controls for regular backups, with the maturity level progressively increasing for each control. These 11 controls can be boiled down to:<\/p>\n\n\n\n

  1. Perform and Retain Backups<\/strong>: Organizations should perform and retain<\/a> backups of data, applications, and settings according to business criticality and continuity requirements. This involves classifying data, determining recovery point objectives (RPO) and recovery time objectives (RTO), and deciding the frequency and retention period of backups.<\/li>
  2. Synchronization<\/strong>: Backups should be synchronized to enable restoration to a common point in time. This is crucial for applications like databases, where related files must be restored together. Using point-in-time snapshots, such as VSS snapshots, ensures consistency across all files.<\/li>
  3. Secure and Resilient Storage<\/strong>: Backups must be stored securely and resiliently. This includes using offsite and offline backups<\/a>, ensuring reliable backup processes, encrypting backups at rest and in transit, and having quick access to backups when needed.<\/li>
  4. Disaster Recovery Testing<\/strong>: The ACSC recommends full disaster recovery tests at least once a year, rather than simple file restore tests. However, we strongly recommend that you carry out more frequent, and better yet, automated testing<\/a> of your backups to ensure their reliability.<\/li>
  5. Access Control<\/strong>: Backups should be protected from unauthorized access and modifications. Unprivileged accounts should not access or modify backups in order to meet maturity level 1 requirements. However, this control also needs to extend to privileged accounts for higher maturity levels to protect backups from more sophisticated cyber attacks.<\/li>
  6. Immutable Storage<\/strong>: Implementing immutable storage solutions can prevent the modification or deletion of backups during their retention period. This adds an extra layer of security, ensuring data integrity even if the backup administrator account is compromised.<\/li><\/ol>\n\n\n\n

    Cyber Insurance and Backups<\/h2>\n\n\n\n

    As cyber threats increase, so does the importance of cyber insurance. In Australia, the cyber insurance market is expanding rapidly, with a growth rate of approximately 20% year-over-year. However, only about 20% of SMEs currently have cyber insurance, highlighting a significant gap in coverage.<\/p>\n\n\n\n

    Cyber insurance provides financial protection against losses resulting from cyber incidents, including data breaches, ransomware attacks, and business interruptions. Insurers typically assess an organization’s risk exposure through detailed questionnaires, focusing on various aspects of cyber security, including backup practices.<\/p>\n\n\n\n

    Some key questions related to backups in cyber insurance assessments include:<\/p>\n\n\n\n