Resilience

Backup: one isn't enough

Robert Edmonds · November 2026 · 6 min read

Most businesses will tell you they have a backup. In my experience, that isn't enough. When a business is properly hacked, the attackers usually go after the backups too, because a business that can't restore is a business that pays. Good backup means more than one backup, each designed for a different kind of problem.

Different jobs

Backups have more than one job, and one backup rarely does them all well.

• Everyday recovery. Someone deletes the wrong folder, a laptop dies, a server fails, or a supplier has an outage. You need to get a file or a system back quickly, usually from yesterday or the last few hours.
• Cyber recovery. Ransomware has encrypted your systems and the attackers have tried to destroy every copy they can reach. You need a copy they couldn't touch.
• Total loss. A fire, flood or similar event destroys the building or data centre your systems run in. You need a copy somewhere else.

1. A daily backup for everyday problems

Start with the information your business couldn't function without. The NCSC's list is a good prompt: your website, emails, invoicing, documents, contacts and customer information. Add line-of-business systems, such as your CRM, case management or stock system, and the settings needed to rebuild them.

Back these up automatically, at least daily, and make sure someone is alerted when a backup fails. A backup that relies on someone remembering will eventually be missed.

2. Microsoft 365 is not a backup

This is the most common misunderstanding I see. Microsoft 365, Google Workspace, OneDrive and Dropbox keep your data available, but they synchronise it. Delete a file, or have it encrypted by ransomware, and that change syncs too. Deleted items are only kept for a limited period, and these services aren't designed to be a full, independent backup of your business.

If your email and documents live in Microsoft 365, they need their own backup, kept with a separate provider and separate login details.

3. A backup the attackers can't reach

This is the backup that protects you against a cyber attack, and it needs two properties:

• Air-gapped. Disconnected from your network, so an attacker inside your systems can't reach it. The NCSC advises not leaving backup devices connected when they're not in use, because some malware spreads to connected devices.
• Can't be overwritten. Often called immutable. Once written, the backup can't be changed or deleted for a set period, even by someone with admin rights. Many online backup services now offer this.

Protect the backup accounts themselves too. Turn on two-step verification, as the NCSC recommends, and use login details that aren't connected to your day-to-day accounts, so whoever compromises one can't delete the other.

4. Separate your backups from your live systems

There are different types of backup, and a sound setup uses more than one:

• Snapshots on your storage, for fast recovery of recent changes
• Scheduled backups, run more or less often depending on how quickly the data changes and how important it is
• Off-site copies, held somewhere else entirely

Whatever mix you use, the backups must be kept separate from your production systems. A backup on the same network, using the same logins, can be lost in the same incident.

5. Plan for losing a whole site

Cyber attacks aren't the only way to lose everything. A fire, flood or power failure can take out an entire office, server room or data centre. Keep at least one backup in a different location, far enough away that the same event can't affect both. Where your systems are hosted in a data centre, that means a second data centre in a different part of the country.

6. Test that you can restore

Learn how to restore your backups and check they contain everything you need. Go further than restoring one file: find out how long it would take to get the whole business working again from your cyber recovery copy. That number is the one that matters, and it belongs in your recovery plan.