Choose a backup arrangement by the kind of recovery your business needs: a disconnected drive keeps one copy apart from the live system, cloud backup offers an off-site route, and network storage can make local recovery easier to manage across devices. Combining cloud and disconnected copies reduces dependence on either route alone, but every arrangement needs protected access, a suitable retention plan and tested restores. If backups contain customer information, assess the business’s own data-protection obligations before choosing a provider or configuration.
If invoices, contacts or working documents are essential to reopening after an incident, keep a recoverable copy beyond the reach of ordinary access to the live system. The National Cyber Security Centre advises businesses to protect backups against attacks on connected systems and to test restoration.
Remote laptops may need an off-site destination, while a connection outage can complicate a cloud-only restore. Check how staff would recover essential files if broadband or the main premises were unavailable. National Cyber Security Centre recovery guidance calls for identifying critical systems and testing the backup that protects them.
Where copies contain personal information, the choice of provider, access location and retention period needs to fit the business’s actual data and obligations. Information Commissioner’s Office guidance covers security, retention and the conditions under which international-transfer rules apply.
Start with where a usable copy would remain after an incident, then check how staff would restore it and who can change or delete it.
Consider it when: Essential data can be copied to a drive that someone can disconnect, secure and bring back for a restore.
Trade-off: Rotation, physical protection and restore tests become someone’s responsibility; a drive kept at the main site can be lost with it.
Consider it when: Remote devices need an off-site backup destination and the connection can support the intended backup and restore process.
Trade-off: Cloud storage is not automatically safe from compromised backup credentials, and restoration may depend on connectivity.
Consider it when: The business needs both an off-site recovery path and a copy that is not continuously connected.
Trade-off: Both copies need coordinated retention, secure access and separate restore tests.
Consider it when: Several PCs or servers need centrally managed local backups and someone can administer the storage.
Trade-off: Network-reachable storage is not an offline copy; it still needs separated access and another recovery location.
| Concern | What to check | Who this matters to |
|---|---|---|
| Recoverable copies | Check protection against unauthorised changes or deletion, and test a restore of the files or systems you need. | If an incident reaches our working files, I need a usable copy that remains accessible for recovery; around 31% of consumers put recoverability first. |
| Customer-information controls | Map the data and its retention schedule; review provider roles and where personal information can be accessed. | When customer records are in a backup, I need to understand who handles them and how long copies remain; roughly 25% of consumers make these controls their primary concern. |
| Local and off-site recovery | Check the available connection and likely restore process, including whether a local copy and a separate site are needed. | If broadband fails during recovery, I still need a practical way to reach essential files; around 25% of consumers prioritise recovery across locations and connectivity disruptions. |
| Managing multiple devices | Confirm support for the actual devices and workloads, and assign responsibility for failed jobs and restore tests. | With several devices and little time to administer them, I need backup tasks that someone can monitor consistently; approximately 19% of consumers put manageable operation first. |
A network-reachable NAS or attached drive may be exposed if an attacker gains access to backup systems or credentials. The National Cyber Security Centre advises protecting both backup access and on-premises equipment.
Identify which copies are connected, separately administered, physically disconnected or off-site. Disconnect a drive when its backup task is complete if it is meant to serve as an offline copy.
Backblaze says Object Lock is disabled by default and does not make files uploaded before a retention policy immutable. Acronis says its immutable recovery points cannot be changed or deleted during their configured retention period.
Check when protection begins, how long it lasts and how the chosen backup application handles expiry; test both restoration and retention behaviour before relying on the setting.
The Information Commissioner’s Office advises setting retention periods around business needs and applicable requirements. Whether international-transfer rules apply depends on the actual organisations and access locations involved.
Identify the information being copied, provider and sub-processor roles, retention needs and access locations before selecting a service or storage region.
Changing provider arrangements later may also mean reviewing contracts and moving stored copies.
A completed copy does not show that staff can restore the files or systems needed to operate. The National Cyber Security Centre advises regular restoration tests.
Restore representative files and, where necessary, a device or system; record the time taken, required access and anything missing.
An untested restore can leave staff doing manual recovery work while essential systems are unavailable.
A network-storage and backup-software route for businesses managing copies from several devices or supported workloads.
A backup-service route for businesses assessing cloud-backed recovery points and formal retention settings.
An object-storage route for businesses or IT providers able to configure compatible backup software and retention controls.
A disconnected drive can provide a useful recovery copy, but it should not automatically be the only one. Secure and test it, and consider how the business would recover if the drive and main premises were affected together. The National Cyber Security Centre advises regular backups and restoration tests.
Test restores regularly, with a schedule based on how critical the protected files and systems are. The National Cyber Security Centre advises regular restoration testing; include the files or systems staff would actually need to resume work.
Not necessarily: the relevant question is whether the actual data flow meets the conditions for a restricted international transfer. Information Commissioner’s Office guidance explains that such a transfer needs an applicable mechanism. Check the provider, sub-processors and access locations rather than relying on its sales location.
Yes, if a configured lock prevents deletion beyond the period the business needs to keep the information. The Information Commissioner’s Office advises a retention schedule reflecting business needs and applicable requirements; check that schedule before setting immutable retention, particularly for backups containing personal information.
Check who can administer backups, access physical media and alter or delete recovery points. The National Cyber Security Centre advises reviewing physical access to on-premises backups; for either route, keep backup administration separate from unnecessarily broad everyday access.