# Cyber Essentials backup requirements explained > Does Cyber Essentials require backups? Not as a technical control. What v3.3 says, why Plus does not test them, and the backup standard IASME recommends. Source: https://wharfcloud.co.uk/guides/cyber-essentials-backup-requirements · Last updated 21 October 2026 · WharfCloud Published 21 October 2026. Reading time about 6 minutes. ## Short answer Backups are not a technical requirement of Cyber Essentials. The NCSC's requirements document for version 3.3 (April 2026) says so in one line, then highly recommends an appropriate backup solution and lists "importance of backing up data is emphasised" among the changes in that version. Cyber Essentials Plus assesses the same five technical controls, so it does not test your backups either. IASME, the NCSC's official Cyber Essentials Delivery Partner, explains why: the controls are defensive, and a backup is what saves you when an attack gets through. Its 2022 guidance sets a practical standard: three copies in different places with one off site, daily backups (weekly at the least) and a test restore at least once a month. ## What the Cyber Essentials requirements say Section C of "Cyber Essentials: Requirements for IT Infrastructure" v3.3 is called "Backing up your data". In summary, it says: - Backing up your data is **not a technical requirement** of Cyber Essentials, but the NCSC highly recommends an appropriate backup solution. - Backing up means saving a copy of your information to another device or to cloud storage, so you always have a recent version and recover faster if data is lost or stolen. - Turn on automatic backups where they are available. - If you back up to a USB stick or external hard drive, disconnect it from the computer when a backup is not running. The "What's new" list for v3.3 includes "Importance of backing up data is emphasised". The emphasis grew; the rule did not change. Your certificate still rests on the five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. ## Why backups are not one of the controls IASME's guide to backing up your data gives the reason: the scheme is made of defensive controls that make a successful attack less likely, and a backup is not a defensive control. It becomes essential after an attack, an accident or a disaster, which is why the scheme recommends it rather than tests it. The NCSC's overview of the scheme says Cyber Essentials and Cyber Essentials Plus assess the same five technical controls, with Plus adding independent technical testing. So Plus does not add a backup test either. > **Backups still touch two requirements** Version 3.3 says cloud services cannot be excluded from scope and that authentication to cloud services must always use multi-factor authentication. If you use a cloud backup service, its admin login needs MFA. And a backup server in the assessed scope is still a server: it must run supported, patched software like any other. ## A backup standard to aim for Because Cyber Essentials stops at "highly recommend", use IASME's and the NCSC's own guidance as the bar: Table: Backup practice recommended by IASME (2022 guide) and the NCSC | Practice | What the guidance says | Source | | --- | --- | --- | | Copies | Keep at least three copies of your information, using different backup solutions and locations, with one kept off site. | IASME | | Frequency | Daily backups are good practice; weekly is the minimum recommended. | IASME | | Testing | Test that backups can restore systems or information at least monthly. Relying on a "backup successful" report without practising recovery is one of the biggest causes of failure. | IASME | | Separation | Do not leave backup drives permanently connected, because ransomware attackers target backups they can reach. Always have a recent offline backup of your most important files and data. | IASME and NCSC | | Cloud sync is not a backup | Synced folders can copy ransomware-encrypted files to the cloud. Check that your service keeps versions and has recovery features. | IASME | Our free [backup checklist for UK small businesses](https://wharfcloud.co.uk/guides/uk-small-business-backup-checklist) turns this into questions you can answer in an afternoon. ## If your business runs on a server 1. **Back up the whole server, not just files.** Accounts, ERP and database software keeps data in places a file backup can miss. A restore you can boot is what gets you working again. 2. **Keep one copy out of reach.** Store at least one copy somewhere the server's own admin accounts cannot delete it. 3. **Write down how long a restore takes.** Time a full restore once. That number is what your recovery plan rests on. 4. **Check the server is still supported.** That part is a Cyber Essentials requirement. Windows Server 2016 loses free security updates on 12 January 2027; see our [Cyber Essentials and unsupported software guide](https://wharfcloud.co.uk/guides/cyber-essentials-unsupported-software). Want evidence rather than a feeling? Our [backup and disaster recovery review](https://wharfcloud.co.uk/backup-dr-review) checks what is backed up, where it goes and how long recovery would take, and includes a restore test plan we can run with you without touching your live systems. It helps you answer backup questions with evidence; it is not a certification. ## Frequently asked questions ### Does Cyber Essentials require backups? No. The NCSC's requirements document for v3.3 says backing up your data is not a technical requirement of Cyber Essentials, but highly recommends an appropriate backup solution. ### Does Cyber Essentials Plus test backups? No. The NCSC says Cyber Essentials and Cyber Essentials Plus assess the same five technical controls; Plus adds independent technical testing of those controls. Backups are not one of them. ### Why are backups not part of Cyber Essentials? IASME explains that the scheme is made of defensive controls that reduce the chance of a successful attack. A backup does not prevent an attack; it is what you rely on afterwards, so the scheme recommends it instead. ### Is OneDrive or Dropbox a backup? Not on its own. IASME points out that synced folders can copy ransomware-encrypted files to the cloud. Check that versioning and recovery features are turned on, and keep a separate backup. ### How often should a small business back up? IASME says daily backups are good practice and weekly is the minimum it recommends, with a test restore at least monthly. ### Does a cloud backup service need MFA for Cyber Essentials? Yes, if it is in scope. Version 3.3 says cloud services cannot be excluded from scope and that authentication to cloud services must always use multi-factor authentication. ## Sources - [NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026), PDF](https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf) - [NCSC: About Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview) - [IASME: The Cyber Essentials guide to backing up your data (31 March 2022)](https://iasme.co.uk/articles/the-cyber-essentials-guide-to-backing-up-your-data/) - [NCSC: Mitigating malware and ransomware attacks](https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks) - [Microsoft Lifecycle: Windows Server 2016](https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016) --- WharfCloud is a trading name of Sunucu Internet Services Consultancy Ltd, registered in England and Wales, company number 12963678. Not VAT registered. Support: engineers Monday to Friday, 08:00 to 18:00 UK time. Critical incidents: A person responds to critical incidents within 1 hour (Every day, 07:00 to 23:00 UK time). Automated monitoring and automated recovery overnight and at weekends. Contact: hello@wharfcloud.co.uk · https://wharfcloud.co.uk/contact