Backup and Recovery Policy

Make sure you can get your data and systems back after ransomware, hardware failure or human error – 3-2-1 and immutable backups, recovery targets, monitoring and a restore testing log.

Editable Word document
13
10pages
Guidance notes included
aml consultancy solutions

IT & cyber security

Backup and Recovery Policy

About this document

What it’s for

A policy and set of records for backing up your data and systems and proving you can restore them. It covers what to back up (including Microsoft 365, Google Workspace and other cloud apps), the 3-2-1 rule, immutable and offline copies that ransomware cannot reach, recovery point and recovery time objectives, daily checks and regular restore tests.

When to use it

  • To set out, with your IT provider, how your backups are done and checked
  • When an insurer, client or Cyber Essentials assessor asks how you back up
  • After a near miss, to check your recovery plan really works

What’s inside

The document is laid out in the sections below. Each one comes with a plain-English guidance note explaining what it does and what to change.

  1. Purpose
  2. Scope
  3. Definitions
  4. Roles and responsibilities
  5. What we back up
  6. The 3-2-1 approach and protecting Backups from attack
  7. Backup frequency and retention
  8. Recovery targets
  9. Monitoring Backups
  10. Restore testing
  11. Recovery procedure
  12. Suppliers and cloud services
  13. Security of Backup media and disposal
  14. Training, records and review
  15. Purpose
  16. Scope
  17. Definitions
  18. Roles and responsibilities
  19. What we back up
  20. The 3-2-1 approach and protecting Backups from attack
  21. Backup frequency and retention
  22. Recovery targets
  23. Monitoring Backups
  24. Restore testing
  25. Recovery procedure
  26. Suppliers and cloud services
  27. Security of Backup media and disposal
  28. Training, records and review

Also included

  • Recovery steps
  • Workarounds while the system is unavailable
  • Six-monthly register review
  • Restore test record
  • Restore test summary log

How to complete it

  • Complete the system register in Appendix A first – it drives the rest
  • Agree realistic recovery targets with the directors and IT provider (clause 8)
  • Use Appendices C and D every week and every test, and keep them

Key points to check

  • File sync (OneDrive, Dropbox, Google Drive) is not a backup on its own
  • A backup that has never been test-restored should not be relied on

Our templates are professionally structured starting points for UK businesses, not legal advice. For anything complex, unusual or high-value, have your final version checked by a solicitor.

Included in the pack

IT & cyber security

£20

for every document in this category

Editable Microsoft Word files

Guidance notes in every document

Written for UK businesses

Download and keep

Get the packSee every document in this pack →

Need more than one category?

Documents All-Access gives you every category for 12 months for £295.

Compare options →

Need it tailored?

We can adapt any template to your business, or write a document from scratch.

Talk to us →