Backups

The 11 checks in the “Backups” category of a SQL Server audit: what each one verifies, its severity and the versions covered.

Checks in this category

BACK001
Recent Full Backup
Critical
Each database must have a Full backup less than 7 days old
Versions : 2012-2025
BACK003
Recent Log Backup
Critical
Databases in Full/Bulk-Logged mode need frequent log backups
Versions : 2012-2025
BACK009
Backups written to the NUL device
Critical
Detects backups written to the NUL device. They are discarded on write yet recorded as successful in msdb, which turns the backup-recency checks green.
Versions : 2012-2025
BACK007
Backup on Same Disk
High
Backups should not be on the same disk as data
Versions : 2012-2025
BACK010
Backup encryption
High
Checks that every backed-up database is covered either by AES backup encryption or by TDE. A clear-text backup file is a complete, portable copy of the database, readable without any authentication.
Versions : 2012-2025
DR004
Backups separated to a DR site
High
Extends backup checks: verifies at least one recent copy is off-host (UNC, Azure URL, or replicated storage).
Versions : 2012-2025
BACK006
Backup CHECKSUM
Medium
Backups should include CHECKSUM for validation
Versions : 2012-2025
BACK008
MSDB History Retention
Low
Backup history in MSDB should be retained
Versions : 2012-2025
BACK002
Differential Backup Configured
Info
Differential backups reduce restore time
Versions : 2012-2025
BACK004
Consistent Recovery Model
Info
Recovery model must match recovery requirements
Versions : 2012-2025
BACK005
Backup Compression
Info
Backup compression reduces space and time
Versions : 2012-2025