A backup checklist for UK small businesses

The NCSC reports that ransomware has encrypted not just live data but also the USB drives, network storage and connected cloud locations holding backups, in its post on offline backups (opens in a new tab). The other common failures are less dramatic: a job that quietly stopped months ago, a system nobody added to the backup, or a restore that takes three days because nobody has done one before.

The checklist below is ordered by impact. Work through it with whoever runs your IT; it does not need special tools.

Coverage

1. 01List what you would miss. Write down every system whose loss would stop work: accounts software, file shares, email, the CRM, the website, line-of-business databases.
2. 02Mark each one as backed up or not. Include cloud services. Microsoft 365 and Google Workspace keep the service running, but recovering from your own deletions, a departed employee or a compromised account depends on your retention settings or a separate backup.
3. 03Check the frequency matches the pain. If losing a day of accounts entries would be a disaster, a nightly backup is your limit. Write down the acceptable loss for each system (your recovery point objective).

Separation

1. 01Keep three copies on two kinds of storage, one off site. The long-standing 3-2-1 rule still works as a minimum.
2. 02Make one copy unreachable. At least one backup should be offline, or stored with immutability (object lock) so that even an administrator cannot delete it before its retention period ends.
3. 03Separate the credentials. The account that can delete backups should not be the same everyday admin account used on your servers, and it should use multi-factor authentication.

Monitoring

1. 01Make failures loud. Backup failure emails should go to a shared mailbox or ticket queue that someone reads, not to a former employee.
2. 02Look at the console monthly. Confirm the last successful backup date for every system on your list from step 1.
3. 03Watch the size. A backup that suddenly shrinks or stops growing often means a folder or database was dropped from the job.

Recovery

1. 01Restore something every quarter. Pick a file, a mailbox or a whole server, restore it somewhere safe and check it opens.
2. 02Time a full restore once a year. Measure how long it takes to bring back your most important system end to end. That is your real recovery time, and it is usually longer than people guess.
3. 03Write the plan down and store it outside your systems. Who to call, where the backups are, which passwords are needed and in which order systems come back. Keep a printed or offline copy: you cannot read a plan stored on an encrypted file share.

The NCSC's offline backups post sets out simple rules for cloud backups: keep at least one backup offline at any time, protect access with strong identity controls, and make sure backups cannot be deleted or overwritten by the same credentials an attacker might steal. Immutable storage and separate backup accounts implement those rules in practice.

Also plan for the time you will need. Restoring after ransomware means rebuilding clean systems first and restoring data onto them, not just copying files back onto infected machines.

If you worked through the list and found gaps you cannot close yourself, that is normal. Our fixed-price backup and disaster recovery review checks all of the above against your actual systems and gives you a prioritised fix list. If you would rather not run servers at all, our managed servers include backups and restore help.