Short answer
A backup only protects against ransomware if attackers cannot encrypt or delete it as well. Keep at least one copy separated or immutable, and test restoring it regularly.
Step by step
- 01
Identify key data and systems
Which data do you need to keep working? Typically accounting, customer data, project files, the shop database and email.
- 02
Apply the 3-2-1 rule
Three copies of your data, on two different media, one of them off-site or separated from the network.
- 03
Separate backups or make them immutable
Use storage media kept offline, or storage with immutability or versioning features. A permanently connected network drive is not enough.
- 04
Protect backup access
Use separate credentials with MFA for backup management, apart from your regular administrator accounts.
- 05
Include cloud services
Cloud services such as email or document storage also benefit from your own backup; providers' retention periods are often limited.
- 06
Test restoring
Regularly restore individual files and, at least once a year, an entire system – and measure how long it takes.
Checklist
- Critical data and systems documented
- At least one separated or immutable copy
- Backup access with MFA and separate accounts
- Cloud data included in backups
- Last restore test on: ____
- Person responsible for backups named
Common mistakes
- Confusing sync with backup – deleted or encrypted files are synced too.
- Leaving the backup drive permanently connected.
- Never testing whether restoring actually works.
- Using the same admin credentials for systems and backups.
Frequently asked questions
How often should we back up?
As often as you can afford to lose data. If you create important data every day, back up at least daily.
Is cloud storage enough as a backup?
Only if it keeps versions and is protected against deletion via compromised accounts. Plain sync is not a backup.
How long should backups be kept?
Attackers sometimes go unnoticed in a network for a while. Several generations over a few weeks improve the chance of a clean version. Also observe legal retention requirements.
Do insurers require backups?
Many cyber insurers ask about backups in the application. The specific requirements are set out in the relevant terms.
Sources
Checked on 6 Oct 2026.