For operational files, choose a backup arrangement with recoverable copies that are not all reachable through the same device or account. A cloud backup paired with a separate offline or otherwise isolated copy can provide two recovery paths; a NAS can serve several local devices, while a removable drive works as a second copy only if backups are run, stored separately and tested.
The National Cyber Security Centre advises small organisations to back up the data they need to operate, including email, invoices, documents and customer information.
If work depends on information held on staff devices or in online services, identify what must be recoverable after a device or service incident. The National Cyber Security Centre includes websites, contacts and customer information among the data small organisations should consider.
Teams relying on Exchange Online, OneDrive or SharePoint should check how they would restore those workloads. Microsoft distinguishes backup recovery from ordinary file versions and other recovery functions, particularly for large-scale incidents.
A drive that can be disconnected offers a separate local recovery path when internet access is unreliable or a copy needs to be kept away from everyday devices. The National Cyber Security Centre warns that connected USB and network drives have been affected in ransomware incidents.
List the data and systems needed to resume work, then check how each proposed copy is protected and restored. A cloud service, NAS and removable drive can play different roles; storage capacity alone does not establish a recovery plan.
| Priority | What to check | Your needs |
|---|---|---|
| Restore coverage | List the locations of email, invoices, documents, website content and customer records. Check covered workloads, recovery points and a restore procedure using your own files and permissions; the National Cyber Security Centre advises regular restore tests. | I need to recover the information that keeps work moving, not just files saved on one computer. |
| Copy separation | Check whether an off-site or cloud copy and an offline or otherwise isolated copy can be kept apart. The National Cyber Security Centre warns that on-premises and cloud backups are not ransomware-resistant by default. | If a device or account is compromised, I do not want it to give access to every backup as well. |
| Access and retention | Review who can change or delete backups, whether administration uses separate credentials, and how long recovery versions remain available. The National Cyber Security Centre recommends separate on-premises backup credentials and advance retention policies for cloud backups. | After an accidental deletion or cyber incident, I need a usable earlier copy that an everyday work account cannot simply remove. |
| Local and off-site recovery | Check whether broadband can support the backup schedule and whether an on-site restore path is needed. For a NAS, confirm a separate destination and restricted management access; a reachable NAS is not an isolated copy. | Large restores may need a local path, but I also want a copy away from the equipment used each day. |
| Personal information | Assess encryption for removable media, protect recovery keys separately and restrict physical and administrator access. The Information Commissioner’s Office identifies encryption of stored personal information, including backup media, as a protection against unauthorised access. | If a portable copy containing personal information is lost, I need its contents and credentials protected. |
The National Cyber Security Centre has seen ransomware affect connected USB and network storage as well as the original data. A continuously reachable backup may be damaged in the same incident.
Keep a copy offline or otherwise isolated when it is not being written, and limit which devices and accounts can alter backups.
A drive’s capacity does not show whether mailboxes, cloud files or earlier versions are covered. Microsoft also distinguishes ordinary file versions from recovery designed for a large-scale incident.
Inventory each data location and check workload coverage, recovery points, retention and the restore workflow before relying on a service or device.
A lost backup drive can expose the information it contains. The Information Commissioner’s Office identifies encryption as a way to protect personal information stored on backup media.
Assess whether encryption is appropriate, use strong credentials and keep recovery keys separate from the drive.
The National Cyber Security Centre says organisations must consider how they configure cloud services securely; provider selection alone does not settle access and backup-protection settings.
Check recovery versions, retention and deletion controls, alerts and administrator access, then restrict permissions for destructive actions.
These examples describe particular backup products and services, not every product from each brand or the devices listed below.
A NAS software route for central local backups with a separate destination.
A backup-service route for organisations using covered Microsoft 365 workloads.
A portable SSD route for a removable secondary copy.
An external-drive route for computer-to-removable-storage backups.
These portable hard drives and SSDs are options for a removable copy of operational files. Choose one alongside a separate recovery path, and check the backup software, device compatibility and restore process needed for your data.
No image availableA portable 5TB hard drive to consider for a removable local copy. For a team using more than one operating system, check drive and backup-software compatibility; also confirm that the software covers the required files and restore process.
No image availableA 4TB portable SSD for a removable copy between compatible devices. Check the available USB connection and, before storing sensitive files, confirm the encryption setup and how backups and restores will be carried out.
No image availableThis 2TB portable hard drive offers a removable local-copy route. Check which operational data the backup software can cover, its recovery window and compatibility with the organisation’s devices; keep another copy separately.
No image availableA 1TB portable SSD to consider for a removable copy. Confirm whether encryption can be enabled for sensitive files, and arrange backups and restore tests as part of a wider recovery plan.
No image availableA 4TB portable hard drive for a separate local copy. Check formatting for the computers in use, and choose backup software that covers the required files and supports a workable restore procedure.
Do not assume that syncing provides the recovery you need. Check the service’s covered workloads, recovery points, retention, deletion protection and restore workflow. Microsoft notes that ordinary versions have limitations for large-scale ransomware recovery.
Use separate recovery paths where practical, rather than leaving every copy exposed to one device or account. The National Cyber Security Centre advises small organisations to consider online storage alongside a storage device and warns that backups are not resistant to destructive attacks by default.
Do not treat a reachable NAS as an isolated backup. A NAS can provide a central local destination, but the National Cyber Security Centre warns that connected network storage can be affected in ransomware incidents; check how to isolate it and maintain a separate copy.
Assess encryption, access controls and how recovery keys will be kept separate from the device. The Information Commissioner’s Office identifies encryption of backup media as a protection against unauthorised access to stored personal information.
Set a regular test schedule that reflects how quickly the organisation needs to resume work, and test again after material changes to systems or backup settings. The National Cyber Security Centre advises checking that staff know how to restore files and that restoration works as expected.