Business backup and recovery: the UK guide
Key takeaways
- The NCSC says up-to-date backups are the most effective way of recovering from a ransomware attack, and that you should always have a recent offline backup of your most important data
- With at least one backup offline at any given time, the NCSC says an incident cannot affect all of your backups at once
- The NCSC says backups should be kept for a retention period that fits your risk appetite, and monitored and tested regularly
- Microsoft's shared responsibility model says you are responsible for protecting your data and identities in the cloud
- Set recovery point and recovery time objectives first, then design backups and test restores against them
Backups are one layer of defence against IT failures, from a deleted folder to a ransomware attack. This guide brings together what UK organisations need to know, with links to our detailed guides on each part. Start here, then follow the links for the parts you need.
What the NCSC says matters most
The NCSC is direct about this. It says up-to-date backups are the most effective way of recovering from a ransomware attack, and that it is essential to always have a recent offline backup of your most important files and data.
The word offline matters. The NCSC says the purpose of an offline backup is to remain unaffected if an incident hits your live environment, and that with at least one backup offline at any given time, an incident cannot affect all of your backups at once. Cloud storage can hold an offline copy, but the NCSC says it also needs to be digitally disconnected when it is not in use, because you cannot unplug cloud storage.
Build the backup
Follow the 3-2-1 rule. The basic idea is three copies of the data, on two different types of storage media, with one copy offsite. Our guide to the 3-2-1 backup rule explains how to apply it with today's cloud and offline options.
Protect at least one copy from attackers. Ransomware goes after backups too. Our guide to immutable vs air-gapped backups compares locked copies with disconnected ones, and how long to keep each.
Get a copy offsite. For smaller organisations, our guide to offsite backup for small businesses, including your NAS covers cloud and physical options.
Do not assume the cloud backs you up. Microsoft's shared responsibility model says you are responsible for protecting the security of your data and identities, whichever cloud service you use. Our guide to Microsoft and Google Workspace backup sets out what each platform keeps and where the gaps are.
Decide how long to keep it
The NCSC says a backup service should let you store backups for a retention period that aligns with your risk appetite. Keep copies long enough to go back past a problem that is found late. Our backup retention policy guide gives worked examples, and our guide to UK GDPR and backups covers storage limitation and the right to erasure.
Set recovery targets
Two numbers drive most backup decisions. NIST defines the recovery point objective (RPO) as the point in time to which data must be recovered after an outage. It defines the recovery time objective (RTO) as the overall length of time a system's components can be in the recovery phase before the organisation's mission or business processes are harmed. Our guide to RPO, RTO and MTD explains how to set them.
In our view, set these targets first, for each important system, and then choose backup frequency and recovery methods that meet them.
Plan the recovery
A backup is not a recovery plan. NIST describes a business continuity plan as a predetermined set of instructions or procedures for how business processes will be sustained during and after a significant disruption. Our guide to backup vs disaster recovery, and BC vs DR plans explains how backups, disaster recovery and business continuity fit together.
For ransomware in particular, see our ransomware recovery and incident response plan guide.
Test it
The NCSC says system owners should monitor and test the state of their backups regularly. It also says to watch for significant changes, such as mass deletion requests, backups stopping or changes to global retention periods. Our guide to how often to test DR and business continuity plans covers frequency and what a good test includes.
Rules for regulated firms
Financial services firms with EU operations or EU clients should read our guide to DORA backup requirements for UK firms.
FAQ
What is the most important backup rule?
The NCSC says it is essential to always have a recent offline backup of your most important files and data, and that up-to-date backups are the most effective way of recovering from a ransomware attack.
What is the 3-2-1 backup rule?
Three copies of the data, stored on two different types of storage media, with one copy kept offsite. Our guide explains how to apply it today, including cloud and offline copies.
What is the difference between RPO and RTO?
NIST defines the recovery point objective as the point in time to which data must be recovered after an outage, and the recovery time objective as how long systems can be in the recovery phase before the organisation is harmed.
How often should backups be tested?
The NCSC says system owners should monitor and test the state of their backups regularly. Our guide to testing disaster recovery plans covers how often, and what a test should include.
Does my cloud provider back up my data?
Microsoft's shared responsibility model says you own your data and identities, and are responsible for protecting their security, whichever cloud service you use.
