PROTECT · BACKUPS & RECOVERY
Backups & Recovery — Could You Get Your Business Back?
Having a backup is reassuring. Knowing that you can restore what the business needs is much more useful.
Why backups matter
Information can disappear because of hardware failure, accidental deletion, ransomware, damaged devices, supplier problems or simple human error.
A backup gives the business another copy to recover from. But the objective is not merely to create copies. The objective is to restore the information and services needed to operate.
Start with what the business cannot afford to lose
Ask which information supports customers, payments, operations, legal obligations and important decisions. Those answers help determine what needs to be backed up and how quickly it may need to be recovered.
Do not forget information held in cloud services. A service being “in the cloud” does not automatically answer your recovery requirements.
Keep recovery options protected
A backup that is always connected to the same environment may be affected by the same incident. The business should understand how backup copies are separated or otherwise protected from loss, alteration and unauthorised access.
Access to backup administration should also be controlled because the ability to delete recovery copies can be extremely valuable to an attacker.
A backup is only useful if restoration works
A successful backup notification tells you that a process ran. It does not necessarily prove that the right information can be restored in the time the business expects.
Test recovery. Choose something important, restore it safely and confirm that it is complete, usable and understood by the people who would need it during a real incident.
BOI ACTION
Pick one important business file or system and trace its recovery.
Ask: Is it backed up? Where is the recovery copy? Who can restore it? When was a restore last tested?
If the answer ends at “the supplier handles it”, ask the supplier what recovery actually looks like for your business.
A useful question for the business
If this information vanished at 9am tomorrow, when could we realistically use it again?
Don’t assume. Check.
Do not measure backup confidence by the existence of a green tick alone. Check that recovery works.
NOT SURE WHERE TO START?
Take the 15-Minute Business Security Check
Use ten questions to identify three areas worth looking at first.
Useful guidance
Final publication QA will verify current UK-first backup and recovery guidance and supporting authoritative sources.
Continue exploring
Your own recovery can still depend on organisations outside your business.
Explore the Cyber Security Guides →
Found something that may be outdated or incorrect? Let us know.
Better Decisions. Stronger Organisations.
Understand what matters. Take sensible action. Check whether it worked.
