Small-Business Backup & Disaster Recovery Checklist UK (2026)
UK small-business resilience guide — checked 7 October 2026: This checklist is based on current National Cyber Security Centre guidance for small organisations and ransomware-resistant backups. It is not a substitute for professional disaster-recovery planning for highly regulated or mission-critical environments.
Quick answer
A small business needs more than “a backup”. It needs recent copies of critical data, at least one copy that an attacker or failed device cannot easily destroy, and a tested way to restore the information. The practical minimum is to identify business-critical data, automate regular backups, keep an independent/offline or separately protected copy, secure cloud backup accounts with MFA, and test recovery before an emergency.
What data actually needs protecting?
Start with the information the business cannot operate without. That normally includes customer records, accounts, invoices, contracts, email, calendars, shared documents, website data, passwords/recovery information, configuration files and any line-of-business data held in specialist software.
Do not assume a SaaS platform automatically gives you a complete disaster-recovery copy. Some services keep deleted files or previous versions, but the NCSC advises organisations not to rely on those features alone for critical information.
The 3-2-1 idea in plain English
A widely used resilience model is to keep at least three copies of important information, across two types of storage, with one copy held offsite or otherwise isolated. The exact implementation can vary, but the principle is simple: one hardware failure, burglary, cloud-account compromise or ransomware event should not destroy every recoverable copy.
| Copy | Example | Why it exists |
|---|---|---|
| Working copy | PC, server, NAS or cloud workspace | Day-to-day operations |
| Backup copy | Cloud backup or local backup appliance | Fast recovery from deletion/failure |
| Independent copy | Offline drive, separate service or isolated backup | Protection if the primary environment is compromised |
Step 1: decide your recovery priorities
Not every file needs the same recovery time. Write down which systems must return first after an incident. Payroll and accounting may matter more than archived marketing photos; a bookings database may matter more than old project files. This becomes the basis of your recovery order.
For each critical system, record:
- where the live data is stored;
- where backups are stored;
- who has administrator access;
- how often the backup runs;
- how far back versions are retained;
- how to restore it;
- who owns the recovery task.
Step 2: automate regular backups
Manual backups are easy to forget. Use automatic schedules wherever possible. The right frequency depends on how much data the business can afford to lose. A company that enters orders all day may need far more frequent protection than one that updates a document archive once a week.
Check failed-job alerts. A backup system that silently stopped six months ago is not a recovery plan.
Step 3: keep at least one copy isolated
NCSC ransomware guidance warns that attackers often target backups deliberately. A permanently connected USB drive, open network share or cloud repository using the same compromised administrator account can be deleted alongside the production data.
Options include an offline removable drive, immutable/version-protected cloud backup, separate backup credentials, restricted administration, or a backup appliance that can be isolated from normal users. If you use removable storage, disconnect it when the backup is complete and store it securely.
Step 4: protect cloud backups with MFA
Enable multi-factor authentication on backup and cloud-storage accounts. Administrator access should be tightly controlled and should not depend on the same credentials used for everyday work. Review who can delete backups, change retention or disable protection.
Step 5: test restores—not just backups
A successful backup notification does not prove the data is usable. Regularly restore a sample file, mailbox, folder, database or virtual machine and check that it opens correctly. At least periodically, practise a wider recovery scenario so staff know the sequence.
The NCSC specifically recommends knowing how to restore backups and checking that the backup contains the important data you expect.
Cloud storage is not the same as backup
OneDrive, Google Drive and similar services provide synchronisation, versioning and retention features, but synchronisation can also replicate deletions or corruption. For business-critical information, consider whether an independent backup of the cloud service is required.
See our Business NAS & Shared Storage guide for local storage planning and our External SSD guide for portable/offline storage options.
Do you need a NAS?
A NAS can be useful as a local backup target, shared-storage platform or staging point for another offsite backup, but it should not be the only copy. A NAS permanently reachable from compromised computers can also be attacked. Keep its software updated, restrict administrative access and replicate important data elsewhere.
Build a one-page recovery plan
- Incident lead: who coordinates the response?
- Critical contacts: IT provider, cloud vendors, insurer, key suppliers and management.
- First systems to restore: list them in order.
- Backup locations: record where each recovery copy lives.
- Credentials: make sure emergency access is available securely even if normal identity systems fail.
- Communication: decide how staff communicate if email or Teams is unavailable.
- External reporting: know when insurers, regulators, customers or law enforcement may need to be informed.
Example schedule for a small office
A simple environment might use continuous or hourly cloud file protection, nightly workstation/server/NAS backups, and a weekly or monthly independent offline copy depending on change rate. The exact schedule should follow business risk, not a generic template.
How we researched this guide
We used the NCSC Small Organisations Guide to Cyber Security, Small Business Response & Recovery guidance, guidance on using online services safely, and the NCSC ransomware-resistant backup principles. The NCSC recommends regular backups, independent copies, 2-step verification for online backups, documented incident roles and tested restoration.
Primary sources
- NCSC: Backing up your data
- NCSC: Small Business Response & Recovery
- NCSC: Ransomware-resistant backups
Frequently asked questions
How often should a small business back up?
Often enough that the amount of work lost between backups is acceptable to the business. Some data may justify hourly or continuous protection; other archives may only change weekly.
Is Microsoft 365 or Google Workspace already backed up?
They include resilience, retention and recovery features, but the NCSC advises organisations to make sure essential cloud data can be independently recovered rather than assuming the service alone is a complete backup strategy.
Should backups stay connected?
Not all of them. Keeping at least one copy isolated from everyday systems reduces the chance that ransomware or compromised administrator access can destroy every recovery copy.
Final verdict
A useful disaster-recovery plan is measurable: you know what is backed up, where the copies are, who can access them, how long they are retained and how to restore them. Automate the routine work, isolate at least one copy and practise recovery before you need it.
