Backup & continuity: checklist and advice

Last updated: 18 October 2026 · IT-Checklist editorial team · All changes

A backup is only worth something on the day you restore it. Many businesses only find out after a ransomware attack, a stolen laptop or a broken disk that the backup had been failing for months. Or that it sat on the same drive that is now encrypted.

This topic goes further than asking whether you make backups. It also covers testing, data in the cloud and how long your business can cope without its main systems.

Check where your business stands on backup & continuity

The free IT check asks you these questions. Then you see your score per topic and advice for every gap. You don't need an account.

Start the IT check →

Why this matters

Ransomware actively looks for connected backup drives and network folders and encrypts those too. A backup that is always plugged in doesn't really protect you.

Cloud services such as Microsoft 365 and Google Workspace only keep deleted files for a limited time. Anything an employee or attacker deletes can be gone for good after that.

The 10 questions in this topic, with advice

Each question describes the situation you want to have. The label shows how much the measure weighs in your score. 'Do first' counts the most.

All important data is backed up automatically.
Do first
Set up automatic backups following the 3-2-1 rule: 3 copies, on 2 types of storage, 1 of them off-site or in the cloud.
We have tested restoring a backup in the past year.
Important
A backup you never test is not a backup. Schedule a test restore of a few important files once a year.
At least one backup is offline or at another location (protected against ransomware).
Important
Ransomware also encrypts connected backup drives. Use cloud backup with versioning or a disconnected drive.
We know how long we can operate without our key systems and have a plan for it.
Recommended
Determine per system how long downtime is acceptable and write down how you would keep working (e.g. on paper, by phone).
Important knowledge and passwords do not depend on a single person.
Recommended
Arrange an emergency procedure: at least two people (or a vault solution) can access critical passwords and documentation.
Data in cloud services (email, OneDrive/Google Drive, accounting) is also backed up or has sufficient version history.
Important
'It's in the cloud' is not a backup: deleted or encrypted files are gone after the recycle-bin period. Consider a cloud-to-cloud backup for Microsoft 365/Google Workspace.
Backups are encrypted and only accessible to those who really need them.
Recommended
A backup contains all your sensitive data in one place. Encrypt backups and limit who can access them — otherwise your backup itself becomes the data breach.
We are notified when an automatic backup fails, and action is then taken.
Recommended
Enable failure alerts in your backup software (email or app) and assign someone to respond. Backups that silently fail for months are often only discovered during an incident.
We can keep working during a prolonged power or internet outage (e.g. mobile hotspot, second connection or alternative location).
Recommended
Decide in advance how you keep working without power or internet: 4G/5G hotspot, working from home or another location. Test once whether it actually works.
Business data that is no longer needed (old project data, test environments, expired backups) is actively deleted instead of being kept indefinitely.
Recommended
Schedule a clean-up twice a year: remove old test environments, completed project data and backups past their retention period. Less data lying around means less risk in a breach.

Where to start

Follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one off-site or offline.
Put a reminder in your calendar to restore one file and one folder from backup every quarter. Write down how long it took.
Make sure you get an alert when a backup fails. Agree who picks it up.
Decide for each system how long you can cope without it (an hour, a day, a week) and base your recovery plan on that.

Common mistakes

Treating OneDrive or Dropbox as a backup. A sync service copies encrypted or deleted files straight across as well.
Keeping the passwords and recovery codes you need for a restore only on the systems you want to restore.
Leaving all knowledge of the IT setup with one person. If they are ill or on holiday, recovery stalls.

Backup & continuity: checklist and advice

Why this matters

The 10 questions in this topic, with advice

All important data is backed up automatically.

We have tested restoring a backup in the past year.

At least one backup is offline or at another location (protected against ransomware).

We know how long we can operate without our key systems and have a plan for it.

Important knowledge and passwords do not depend on a single person.

Data in cloud services (email, OneDrive/Google Drive, accounting) is also backed up or has sufficient version history.

Backups are encrypted and only accessible to those who really need them.

We are notified when an automatic backup fails, and action is then taken.

We can keep working during a prolonged power or internet outage (e.g. mobile hotspot, second connection or alternative location).

Business data that is no longer needed (old project data, test environments, expired backups) is actively deleted instead of being kept indefinitely.

Where to start

Common mistakes

Official sources

Read next