Guide
Cyber Essentials backup requirements explained
Published · 6 min read
Short answer
Backups are not a technical requirement of Cyber Essentials. The NCSC's requirements document for version 3.3 (April 2026) says so in one line, then highly recommends an appropriate backup solution and lists "importance of backing up data is emphasised" among the changes in that version. Cyber Essentials Plus assesses the same five technical controls, so it does not test your backups either. IASME, the NCSC's official Cyber Essentials Delivery Partner, explains why: the controls are defensive, and a backup is what saves you when an attack gets through. Its 2022 guidance sets a practical standard: three copies in different places with one off site, daily backups (weekly at the least) and a test restore at least once a month.
What the Cyber Essentials requirements say
Section C of "Cyber Essentials: Requirements for IT Infrastructure" v3.3 is called "Backing up your data". In summary, it says:
- Backing up your data is not a technical requirement of Cyber Essentials, but the NCSC highly recommends an appropriate backup solution.
- Backing up means saving a copy of your information to another device or to cloud storage, so you always have a recent version and recover faster if data is lost or stolen.
- Turn on automatic backups where they are available.
- If you back up to a USB stick or external hard drive, disconnect it from the computer when a backup is not running.
The "What's new" list for v3.3 includes "Importance of backing up data is emphasised". The emphasis grew; the rule did not change. Your certificate still rests on the five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
Why backups are not one of the controls
IASME's guide to backing up your data gives the reason: the scheme is made of defensive controls that make a successful attack less likely, and a backup is not a defensive control. It becomes essential after an attack, an accident or a disaster, which is why the scheme recommends it rather than tests it.
The NCSC's overview of the scheme says Cyber Essentials and Cyber Essentials Plus assess the same five technical controls, with Plus adding independent technical testing. So Plus does not add a backup test either.
A backup standard to aim for
Because Cyber Essentials stops at "highly recommend", use IASME's and the NCSC's own guidance as the bar:
| Practice | What the guidance says | Source |
|---|---|---|
| Copies | Keep at least three copies of your information, using different backup solutions and locations, with one kept off site. | IASME |
| Frequency | Daily backups are good practice; weekly is the minimum recommended. | IASME |
| Testing | Test that backups can restore systems or information at least monthly. Relying on a "backup successful" report without practising recovery is one of the biggest causes of failure. | IASME |
| Separation | Do not leave backup drives permanently connected, because ransomware attackers target backups they can reach. Always have a recent offline backup of your most important files and data. | IASME and NCSC |
| Cloud sync is not a backup | Synced folders can copy ransomware-encrypted files to the cloud. Check that your service keeps versions and has recovery features. | IASME |
Our free backup checklist for UK small businesses turns this into questions you can answer in an afternoon.
If your business runs on a server
- 01
Back up the whole server, not just files
Accounts, ERP and database software keeps data in places a file backup can miss. A restore you can boot is what gets you working again.
- 02
Keep one copy out of reach
Store at least one copy somewhere the server's own admin accounts cannot delete it.
- 03
Write down how long a restore takes
Time a full restore once. That number is what your recovery plan rests on.
- 04
Check the server is still supported
That part is a Cyber Essentials requirement. Windows Server 2016 loses free security updates on 12 January 2027; see our Cyber Essentials and unsupported software guide.
Want evidence rather than a feeling? Our backup and disaster recovery review checks what is backed up, where it goes and how long recovery would take, and includes a restore test plan we can run with you without touching your live systems. It helps you answer backup questions with evidence; it is not a certification.
Sources
- NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026), PDF (opens in a new tab)
- NCSC: About Cyber Essentials (opens in a new tab)
- IASME: The Cyber Essentials guide to backing up your data (31 March 2022) (opens in a new tab)
- NCSC: Mitigating malware and ransomware attacks (opens in a new tab)
- Microsoft Lifecycle: Windows Server 2016 (opens in a new tab)
Facts were checked against these sources on 21 October 2026. Vendor terms change; check the source before relying on a detail.