Backup

What it means

A backup is a copy of data kept separately from the original so that you can restore from it after loss, corruption or encryption by an attacker. The key word is separately - a copy on the same disk is not a backup.

The tested rule says: three copies of the data, on two different kinds of storage, one of them off site. For a small company that means the working data, a local copy and a copy in the cloud.

A backup is not synchronisation. A service that mirrors files between a computer and the cloud also carries over deletion, overwriting or encryption, so after a mistake the company has two equally damaged copies. A backup, by contrast, keeps earlier states that a change to the original does not overwrite.

How it works in practice

What gets backed up: the accounting database, documents, payroll, contracts and e-mail. Retention matters too - how many older versions are kept, so you can return to a point before the error happened.

Backups are encrypted and access to them restricted. If they sit on on-premise storage mapped as a network drive, ransomware encrypts them along with the original.

Before closing the year and before every major update of the accounting software we take a separate backup of the database and label it with the date. If the update damages the data or something breaks during the close, we go back to the exact state before the change, not to a nightly backup several days old.

What to watch out for

An untested backup is an assumption. A trial restore at least annually exposes missing files, invalid passwords and incomplete coverage - and it is the one part of a recovery plan that can be demonstrated rather than promised.

The backups are managed with the same administrator account as the systems themselves. An attacker who gets hold of it deletes the backups first and only then encrypts the data. At least one copy therefore has to be immutable or out of reach of everyday credentials, which is a matter of access control, not of backup technique.