Would your backups actually save you?

The short answer

Having backups and being able to recover from them are two different things. Most businesses I look at have the first. Far fewer have checked the second. A backup only counts if it's recent, it's somewhere an attacker can't reach, and you've actually restored something from it.

Here's how to check yours in an afternoon, without buying anything.

Why backups fail when you need them

When a backup lets a business down, it's rarely because there wasn't one. It's usually one of these:

• It stopped running months ago and the failure emails went to someone who left, or to a folder nobody reads.
• It was reachable from the network. Modern ransomware goes looking for backups first, and a NAS or backup drive that's always connected gets encrypted along with everything else.
• It used the same admin password as everything else, so whoever got in could simply delete it.
• It didn't include the thing you needed. The file server was backed up, but not the accounts package on one laptop, or the line-of-business system, or Microsoft 365.
• Nobody had ever restored from it, so the first test was the real thing, and it took days instead of hours.

The 3-2-1 rule, in plain English

The old rule of thumb still holds up:

• 3 copies of anything that matters: the live data plus two backups.
• 2 different places or types of storage, so one failure can't take out both.
• 1 copy off-site and out of reach: offline, or "immutable", meaning it can't be changed or deleted for a set period, even by an admin.

That last one is what saves you from ransomware. If every copy can be reached with one stolen password, you've got three copies of the same problem.

"But we're on Microsoft 365, so it's backed up"

This is the one I hear most. Microsoft keeps the service running, but it isn't a backup in the way most people think:

• Files deleted from OneDrive and SharePoint sit in the recycle bins for 93 days, then they're gone.
• Deleted emails can be recovered for 14 days by default after the Deleted Items folder is emptied (an admin can raise this to 30).
• If someone with access encrypts or overwrites files, or a leaver's account is removed, those changes sync everywhere, just like a real edit would.

Microsoft's own service agreement recommends you back up your own content. A separate Microsoft 365 backup, whether Microsoft's own add-on or a third-party one, is cheap compared with losing a mailbox.

Check yours this afternoon

1. List what you can't lose. Email, shared files, accounts, CRM, any line-of-business system, and anything that only lives on one person's laptop.
2. Find out where each one is backed up, and how often. If nobody knows, that's your answer.
3. Look at the last successful backup date, not the schedule. Make sure failure alerts go to someone who'll act on them.
4. Check at least one copy is out of reach. Offline, immutable, or with separate logins protected by MFA that aren't used for anything else.
5. Restore something. One folder, one mailbox, ideally one whole system. Time it.
6. Write down how long a full recovery would take, and ask whether the business could survive that long.

How long could you be without it?

Two questions are worth answering before you ever need them:

• How much work could you afford to lose? If the answer is "an hour", a nightly backup isn't enough.
• How long could you be offline? If the answer is "a day", but restoring everything would take a week, that's the gap to close.

Retailer Hobbs and Whistles is a recent reminder of how disruptive a serious cyber incident can be, and that's with a big team behind them. Your business probably has far less room to wait.

FAQ

Does Cyber Essentials require backups?

No. Cyber Essentials covers five technical controls, and backups aren't one of them. They're still one of the most useful things you can get right, and ISO 27001 does expect you to manage them.

Is a USB drive or NAS in the office enough?

Not on its own. If it's plugged in or on the network all the time, ransomware can reach it, and a fire or break-in takes it with the computers. Keep it, but add an off-site copy that's out of reach.

How often should we test a restore?

A small test every quarter, and a bigger one at least once a year or after any big change, like moving to a new system.

What should we do if our backups have been hit?

Stop, don't wipe anything, and treat it as a cyber incident. My incident response line covers stopping the attack and a first look at what's recoverable for a fixed £795.