What is the 3-2-1 backup rule?

The NCSC describes it as keeping at least 3 copies of your data, on 2 devices, with 1 offsite. The point is that no single event — a failed disk, a fire, or a ransomware attack — can destroy every copy at once.

Does Microsoft back up our Microsoft 365 data?

Microsoft protects the availability of the service, not your data in perpetuity. Its own Services Agreement says "We strongly advise you to make regular back-up copies of Your Content." Native retention is time-limited: Microsoft documents a default 30-day retention for a deleted user's OneDrive, after which it moves to the site collection recycle bin for 93 days and is then gone. That is a deletion safety net, not a backup.

What is the difference between RPO and RTO?

RPO (recovery point objective) is how much data you can afford to lose, measured in time — if you back up nightly, your RPO is up to 24 hours. RTO (recovery time objective) is how long you can afford to be down before the impact becomes unacceptable. Agree both with the business before choosing the technology, not after.

Data Backup and Disaster Recovery: A 2026 UK Checklist

Backing up your data is not a technical requirement of Cyber Essentials. That is not our opinion — it is the first line of Section C of Cyber Essentials: Requirements for IT Infrastructure v3.3, the document in force for assessment accounts created from 27 April 2026: “Backing up your data is not a technical requirement of Cyber Essentials. However, we highly recommend implementing an appropriate backup solution.”

Which leaves a gap that a lot of certified firms have not noticed. Cyber Essentials proves your five technical controls are in place. It does not prove you could get your business back if someone got past them. And in the last 12 months, 43% of UK businesses reported a cyber security breach or attack, according to the Cyber Security Breaches Survey 2025/2026 published by DSIT on 30 April 2026.

Here is what a backup and disaster recovery plan needs to contain in 2026, what the NCSC actually asks for, and the checklist we use to test whether a plan is real.

The Gap in the Numbers

The Cyber Security Breaches Survey 2025/2026 (fieldwork August to December 2025) is the best UK-wide picture we have, and it shows a familiar pattern: most organisations back something up, far fewer plan for the recovery.

74% of businesses back up data securely via a cloud service; 48% back up securely via other means.
25% of businesses have a formal incident response plan — rising to 57% of medium-sized businesses and 76% of large businesses, but only 21% of micro businesses.
Among small businesses, having a business continuity plan that addresses cyber security fell to 44%, down from 53% the previous year. Formal policies covering cyber risks fell too, to 52% from 59%.

Read those together and the shape of the problem is clear. Backup is widely adopted as a product. Recovery is not widely adopted as a process. When a firm calls us mid-incident, the sentence we hear is almost never “we have no backups” — it is “we have backups, but we cannot get them back”.

The cost of that gap is measured in downtime, which we have broken down separately.

What Cyber Essentials Actually Says

Because this is regularly misreported, it is worth being precise.

Backups sit in Section C of the v3.3 Requirements document — before the scope and controls sections, which is a deliberate signal of importance — and the wording is a recommendation, not a control:

“Backing up your data is not a technical requirement of Cyber Essentials. However, we highly recommend implementing an appropriate backup solution.”

The document goes on to recommend turning on automatic backups where available, and adds one instruction that is genuinely a security control in disguise: “If you back up your information to a USB stick or an external hard drive, disconnect it from your computer when a backup isn’t being done.”

That is the offline-backup principle in one sentence. A backup permanently attached to the machine it protects is a file, not a backup.

If you are working through what else changed in the April 2026 update, our guide to the Cyber Essentials v3.3 changes covers the mandatory controls. This article covers the part the certificate does not test.

The NCSC Standard: Ransomware-Resistant Backups

The NCSC’s position is that “making regular backups is the most effective way to recover from a destructive ransomware attack” — and that attackers know it. Its guidance notes that “in the early stages of a destructive ransomware attack, actors often target backups and infrastructure, deleting or destroying the data stored there.”

The 3-2-1 rule

The NCSC’s baseline is the familiar one: “at least 3 copies, on 2 devices, and 1 offsite.” The reasoning is simply that no single event should be able to destroy every copy.

For cloud storage, the NCSC adds a point that trips up a lot of otherwise sensible setups: “unlike conventional backup storage, you cannot take your cloud storage offline by simply unplugging it.” Access controls have to do the work instead — allowing authorised clients to write backups and denying connection requests while the storage is not in use.

The six principles for on-premises backups

The NCSC publishes two sets of principles for backups that resist destruction. For on-premises solutions:

Make it possible to isolate your backup solution
Update your backup solution
Backups should be resilient to destructive actions
Restoration from an earlier backup is possible, even if later versions become corrupted
Have in place robust key management for data-at-rest protection
Alerts are triggered if significant changes are made, or privileged actions attempted

The five principles for cloud backups

Backups should be resilient to destructive actions
A backup system should be configured so that it isn’t possible to deny all customer access
The service allows a customer to restore from a backup version, even if later versions become corrupted
Robust key management for data-at-rest protection is in use
Alerts are triggered if significant changes are made, or privileged actions are attempted

Three of these are worth calling out because they are so often missing in practice.

Isolate the credentials. The NCSC is direct about this: in a ransomware attack “it’s common for attackers to discover and then gain access to enterprise admin accounts”. A backup system administered with the same domain admin account as everything else is not isolated from anything. Use separate admin accounts and credentials for the backup solution, and mandate MFA for requests to alter or destroy data.

Retain by time, not by count. The NCSC recommends storing backup data “according to a fixed time period, rather than a fixed number of backups”. If you keep the last 14 backups, an attacker who can run 14 corrupted backups in quick succession has destroyed your recovery without deleting a thing.

Assume your alerting infrastructure is compromised too. Cloud backup services should offer alert delivery that still reaches you if your own infrastructure is down. An alert emailed to a mailbox that is part of the incident is not an alert.

This is the same logic behind immutable storage, which we cover in more depth in our guide to ransomware in 2026.

Most London SMEs now hold their most valuable data in Microsoft 365 — email, SharePoint document libraries, OneDrive, Teams. And most assume Microsoft is backing it up.

Microsoft does not say that. Its own Services Agreement contains two plain statements: “We strongly advise you to make regular back-up copies of Your Content” and “We recommend that you regularly backup Your Content and Data that you store on the Services or store using Third-Party Apps and Services.”

What Microsoft 365 gives you natively is retention and deletion safety nets, and they are time-limited by design. Microsoft’s own documentation sets out the deleted-user process: the default OneDrive retention period is 30 days; seven days before it expires the manager or secondary owner is reminded; after that the OneDrive moves to the site collection recycle bin, “where it’s kept for 93 days”. Then it is gone.

Ninety-three days sounds generous until you consider the two scenarios that matter:

A departure that goes wrong. A dispute surfaces eight months after someone leaves and the evidence lived in their OneDrive. Retention windows do not care that you needed it.
A quiet corruption or malicious deletion. Damage discovered outside the window is not recoverable, and a recycle bin is reachable by an account that has been compromised.

Retention is not backup. If Microsoft 365 holds anything you would be unable to reconstruct — client files, contracts, correspondence with a regulator — it needs a separate, independently controlled copy. That is a licensing and configuration decision, and it belongs in the same conversation as the rest of your Microsoft 365 estate.

The Part Almost Nobody Does: Testing

The NCSC is explicit that its principles “will only be effective in practice if system owners regularly test and monitor the health of the backup data”. This is where good intentions collapse.

A backup job that reports success proves a job ran. It does not prove the data is complete, uncorrupted, decryptable with a key you still hold, or restorable by the person who will actually be doing it — at 6am, on a Sunday, with the phones ringing.

Two numbers should be agreed with the business before any technology is chosen:

RPO (recovery point objective) — how much data you can afford to lose, expressed as time. Nightly backups mean an RPO of up to 24 hours. If losing a day of fee-earner work is unacceptable, nightly is the wrong answer and no amount of storage fixes it.
RTO (recovery time objective) — how long you can be down before the impact becomes unacceptable. This drives whether you need replication and failover or whether a restore-from-backup is proportionate.

Then test against them. A restore test is not “we pulled back a file”. It is: nominate a realistic failure, restore to an isolated environment, confirm the applications actually run, measure how long it took, and write down what broke. Something always breaks the first time. Better on a Tuesday than during an incident.

Tested recovery also happens to be one of the controls underwriters ask about, alongside MFA and patching — see our note on reducing cyber insurance premiums.

Where the Regulation Is Heading

Resilience is moving from good practice towards obligation, though more slowly than the headlines suggest.

The Cyber Security and Resilience (Network and Information Systems) Bill amends the NIS Regulations 2018, extends the regulated perimeter, and updates incident reporting duties. It had its House of Lords second reading on 14 July 2026, with committee stage — the first line-by-line examination — scheduled for 1 September 2026 according to Parliament’s own bill news page. It has not received Royal Assent.

Two things follow for a typical London SME. First, the Bill is aimed at operators of essential services, with managed service providers and data centres brought into scope — it will not directly impose backup duties on most private businesses. Second, and more practically, if you outsource your IT then your provider’s obligations are changing, and that flows down to you through contracts and assurance questions. We covered the direction of travel in our piece on the Cyber Security and Resilience Bill.

Regulated firms — and any business serving EU financial entities — should be reading their recovery testing obligations against DORA as well, where tested resilience is already explicit rather than recommended.

The Checklist

Work through this with your IT team or provider. Any “we think so” is a finding.

Coverage

List every system that would stop the business if it disappeared today — including SaaS platforms, not just servers.
Confirm Microsoft 365 (Exchange, SharePoint, OneDrive, Teams) is covered by an independent backup, not native retention alone.
Confirm line-of-business application databases are backed up in a restorable state, not just as files on disk.

Architecture

Verify 3 copies, on 2 devices, with 1 offsite.
Confirm at least one copy is genuinely isolated — physically disconnected, or access-controlled so it cannot be reached from a compromised network.
Confirm backup storage blocks deletion and alteration for a defined retention period.
Confirm retention is set by time period, not by number of backups.

Access

Confirm the backup system uses admin accounts and credentials separate from the rest of the network.
Confirm MFA is enforced on any request to alter or delete backup data.
Confirm you can still reach your backups if your primary identity provider is unavailable.
Confirm encryption keys are held somewhere that survives the loss of the environment they protect.

Proof

Agree an RPO and RTO per system with the business, in writing.
Run a full restore test at least quarterly, into an isolated environment, and time it.
Document who does what during recovery, and make sure that document exists somewhere other than the network being recovered.
Confirm alerts fire on failed backups, mass deletions and retention changes — and that they reach a human by a route that survives the incident.

If you cannot tick the “Proof” section, you have a backup product rather than a recovery capability. That is the single most common finding in the reviews we run.

How Nerdster Helps

We build and run backup and disaster recovery for London and South East businesses — immutable, offsite, isolated from the production estate, with recovery tested to a schedule and the results documented so you can hand them to a client, an insurer or an assessor.

For our managed IT support clients, restore testing is simply part of how the estate is run rather than an annual scramble. And if you are certifying, we will tell you honestly where Cyber Essentials stops and where your actual recoverability begins — those are not the same line.

If you are not certain your business could be back on its feet next week, book a recovery review. We will test the restore rather than read the backup report.

Sources

NCSC / IASME, Cyber Essentials: Requirements for IT Infrastructure v3.3, April 2026, Section C — ncsc.gov.uk
DSIT, Cyber security breaches survey 2025/2026, published 30 April 2026 (fieldwork Aug–Dec 2025) — gov.uk
NCSC, Ransomware-resistant backups (collection overview and both principle sets) — ncsc.gov.uk
NCSC, Offline backups in an online world — ncsc.gov.uk
Microsoft, Microsoft Services Agreement (sections 2 and 6) — microsoft.com
Microsoft Learn, OneDrive retention and deletion — SharePoint in Microsoft 365 — learn.microsoft.com
UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill — bills.parliament.uk and Cyber Security Bill debated in the Lords — parliament.uk

Last reviewed: 3 August 2026. Cyber Essentials requirements are updated annually and the Cyber Security and Resilience Bill is still before Parliament — check the current position before relying on any dated guidance.