Backup and recovery: a backup only counts if you can prove you can restore from it

Backup software reports what it copied, not what you can get back. A green tick says that data went somewhere last night, not whether the copy is complete, readable and beyond an attacker's reach, or how long it would take to run the business from it. Backup and recovery only work as a pair, and recovery is the half that is easiest to put off.

RansomwareRansomwareMalicious software that encrypts or steals data so that criminals can demand payment for its release. gangs know that: the UK NCSC notes that attackers have destroyed copied files or disrupted recovery processes (source: UK NCSC, September 2021). A backup only counts once you have restored from it, against the clock, with someone from the business checking the result.

Synchronisation keeps every copy identical, and that is exactly the problem: the UK NCSC warns that cloud services often synchronise immediately after files have been replaced with encrypted copies (source: UK NCSC, September 2021).

For an accounting firm with its files in SharePoint, that could mean the original in Microsoft's cloud, a daily immutable backup at a separate provider under its own accounts, and a monthly encrypted copy on a disk kept elsewhere.

The recovery point objective (RPO) is the point in time to which data must be recovered after an outage (source: NIST, May 2010). In plain words: how much work you can afford to lose; with one backup a night, up to a full day. The recovery time objective (RTO) is how long a system may stay in recovery before the business is hurt (source: NIST, May 2010): how long you can do without it. It should be shorter than the maximum tolerable downtime, the outage the owner of the process is willing to accept (source: NIST, May 2010).

Microsoft is explicit about its own cloud: for every deployment type you own your data and identities and are responsible for protecting them (source: Microsoft, August 2026). The services do contain safety nets. Deleted items stay in the SharePoint recycle bin for 93 days, and a document library can be rolled back to any moment in the last 30 days, also after ransomware (source: Microsoft, September 2025). Useful, but these nets sit under the same admin accounts as the data.

For a real backup of SharePoint, OneDrive and Exchange Online, Microsoft sells Microsoft 365 Backup separately, billed on consumption; its storage is append-only, so backups cannot be overwritten, and the data stays within Microsoft's boundary (source: Microsoft, November 2026). That keeps every copy with one supplier, though. The UK NCSC advises keeping an independent copy of data from online services in another safe place or service (source: UK NCSC, January 2024).

• Immutable storage: the backup store offers no way to alter or delete backups, or delays deletion for an agreed period and raises an alert that reliably reaches the owner (source: UK NCSC, November 2024).
• Separate credentials: deleting backups should require compromising a second, separate system (source: UK NCSC, November 2024). Manage backups from dedicated admin workstations, with the MFAMFA (multi-factor authentication)Signing in with a second step besides the password, such as a code or an approval in an app on a phone. method on a device other than the one used to manage them (source: UK NCSC, September 2021).
• An offline copy: devices that hold backups are not permanently connected to your network, and before a recovery they are connected only to known clean devices (source: UK NCSC, September 2021).
• Alerts: significant changes and privileged actions in the backup system trigger an alert (source: UK NCSC, November 2024).

Encryption and keys

Encrypt backups, certainly the copies that leave the building; CISA lists encryption and offline copies among the protections for backups (source: CISA, November 2026). Then protect the key as carefully as the data. The UK NCSC points out that an attacker need not delete the data if they can delete or change the encryption key, and suggests a backup of the key outside the system, such as a master key printed on paper and kept in a safe (source: UK NCSC, November 2024). Make sure someone besides the IT partner knows where it is.

CISA advises testing that your team can restore data both fully and partially, in scheduled recovery tests (source: CISA, November 2026). NIST's contingency planning guide separates a tabletop exercise, a discussion that deploys no equipment, from a functional exercise in which staff carry out their roles; for moderate-impact systems the exercise includes recovery from backup media (source: NIST, May 2010). Time every test against the RTO, and stop the clock when a user can work again, not when the software reports success.

How far back you can go

CISA advises being able to roll back data at least seven days (source: CISA, November 2026). Keep backups for a set period rather than a set number of copies, so that a burst of corrupted backups cannot push out the last clean one (source: UK NCSC, November 2024). If an intrusion goes unnoticed for longer than your retention, every copy already contains it. Two outer limits apply: tax, labour and other record-keeping rules can require a fixed retention period, while privacy rules such as the GDPR require personal data to be kept no longer than necessary (source: European Commission, November 2026). Check both where you operate.

Management owns the limits: which systems matter most, the RPO and RTO of each, and the risk that remains. IT, in-house or outsourced, designs and runs the backups and reports on them. Each process owner checks restored data and keeps a workaround for the days without the system. Outsourcing moves the work, not the responsibility: ask your IT partner whether the backup covers online services, whether a copy sits outside the partner's own accounts and whether agreed recovery times also apply after an attack. For the first hours of an attack, see ransomware response; more guides are in IT and data.