If your systems stopped this morning, how soon would you be back?

It is half past nine on a Tuesday. The shared drive will not open, the accounts system shows an error, and three people are standing by the kettle asking whether anyone else has the same problem. What happens in the next hour depends far more on decisions made months earlier than on anything anyone can do now. The rest of this page is about making them while everything still works.

The short version.

• Ransomware is one way to lose a working day. A failed laptop, a deleted folder, a supplier’s outage, a power cut and a flooded office are others, and the recovery looks much the same.
• Decide two numbers before you buy anything: how much recent work you could afford to lose, and how long you could afford to wait.
• Keep at least one copy that is off site and disconnected, because the NCSC warns that attackers target backups they can reach.
• Cloud sync spreads mistakes too: a file deleted or scrambled on one computer can vanish or be scrambled on every device.
• Only a restore you have actually carried out proves a backup works. Where personal data is involved, the ICO expects that testing to be regular.
• Put names against decisions. Only 39% of UK businesses have assigned incident roles to specific people.

What actually stops a business.

Ransomware has its own guide on this site, so it only appears here in passing. The full list of things that can end a working day is longer, and most of it has nothing to do with criminals.

Equipment fails. A laptop drive dies, the office server will not start, a network switch gives up overnight. If the only copy of something lived on that machine, it went with it.

People make mistakes. Someone deletes the wrong folder, saves over the master price list, or works on the old version of a contract for a week. None of this feels like a disaster at the time, which is why it often goes unnoticed until the file is needed.

Suppliers have bad days. In July 2024 a faulty CrowdStrike security update stopped an estimated 8.5 million Windows computers worldwide. The same day, NHS England reported that an issue with the EMIS patient record system was disrupting the majority of GP practices. In October 2025 a fault in Microsoft’s Azure network disrupted Microsoft 365 and other services for around eight and a half hours. A business can do everything right and still lose a morning to somebody else’s fault.

The power goes. Late on 20 March 2025 a fire at the North Hyde substation in west London cut power to Heathrow, and the airport closed for most of 21 March. The official review traced the fire to a failed transformer component, and found that a high moisture reading taken in 2018 had not led to the action it called for. Small warning signs are easy to file away.

Buildings flood and burn. The Environment Agency estimates that around 6.3 million properties in England are in areas at risk of flooding, and that 4.6 million of those are at risk from surface water: heavy rain that the drains cannot take, often far from any river. In Wales it is about 1 in 7 properties. Fire services in England attended 13,679 fires in buildings other than homes in the year to March 2026.

The Business Continuity Institute, which surveys continuity professionals around the world each year, says extreme weather was the single largest cause of disruption in the year covered by its latest scan, and lists IT and telecoms outages among the top five. The causes vary. The questions afterwards are always the same two.

Two numbers to settle first.

How much work could you afford to lose? If your most recent good copy was taken at midnight, everything done since then is gone and has to be redone or rebuilt from memory. For a design practice that might mean a day of drawings. For a business taking bookings online it could mean orders you no longer know you have. IT people call this the recovery point.

How long could you afford to wait? This is the time from the moment things stop to the moment people are working again. An hour may be fine for the accounts package and unthinkable for the till. IT people call this the recovery time, and it is the phrase the ICO uses too: its ransomware guidance suggests testing that data can be restored within the recovery time objective.

The answers will differ from system to system, and that is useful. Email, files, the line-of-business software and the phones each get their own pair of numbers, which tells you what has to come back first. Shorter numbers cost more to deliver, so the conversation becomes a straightforward trade: what an hour offline costs you against what it costs to avoid it. Settle the numbers, then choose the backup and the kit that meet them. Doing it the other way round means finding out what your setup delivers on the day you need it.

How fast UK businesses get back.

The government’s Cyber Security Breaches Survey asks businesses that found a breach how long their most disruptive one took to recover from. It covers cyber incidents only, not floods or failed servers, but it is the government’s own measure:

Time to recover from the most disruptive breach	Share of businesses
No time at all	72%
Less than a day	15%
More than a day	12%

So 87% were back to normal within a day, down from 92% the year before. Micro businesses slipped the same way, to 86% from 92%. Most incidents are small, and most businesses absorb them. Across all businesses that found a breach, 11% said it stopped staff doing their day-to-day work, and 8% temporarily lost access to files or networks.

Preparation has gone backwards in places. A third of businesses (33%) have a business continuity plan that covers cyber security. Among small businesses the figure fell to 44%, from 53% the year before.

Copies that survive.

Almost every business backs something up: the same survey puts it at 88%. Whether those copies would survive the event that destroyed the original is the real question.

The oldest rule of thumb is 3-2-1, set out by the US government’s computer emergency team in 2012: three copies of anything important, on two different types of storage, with one kept off site. It still works for fire, flood and theft. The NCSC points out its gap: 3-2-1 does not require any copy to be offline, and a copy that is always connected can be reached by whatever reaches your network. Its advice for ransomware is blunt:

• Always keep a recent offline backup of your most important files.
• Do not rely on two copies on a single removable drive, or several copies in a single cloud service.
• Expect attackers to go after connected backups first, to make recovery harder.

For a small office, the NCSC’s own backup page puts it simply. Copy everything the business needs to operate: website, email, invoicing, documents, contacts, customer records. If you use a storage device, unplug it when it is not in use. To be extra safe, keep two backups, one online and one on a device.

Online backup services can close the offline gap too, if they are built for it. One of the NCSC’s principles for ransomware-resistant cloud backups is that you can restore an older version even if the newer ones have been corrupted. That is a question worth putting to any backup provider, including the one you already pay.

Why sync is not a backup.

OneDrive, SharePoint, Google Drive and Dropbox keep your files identical across every device, and they do it very well. That is the problem when something goes wrong. Google’s own help pages say that if you sync files with your computer, anything you put in the bin is put in the bin everywhere. The NCSC warns that cloud services often synchronise immediately after ransomware has replaced your files with scrambled copies.

The platforms do offer ways back. Microsoft 365 subscribers can restore a whole OneDrive to any point in the last 30 days. Those tools are worth knowing about, and the NCSC’s advice is still that you should not rely on them alone: keep an independent copy in another safe place or service. Our cloud migration guide sets out how long Microsoft and Google keep deleted data, and why a problem spotted after a few weeks can be beyond their reach.

A backup nobody has restored.

A backup job that reports success every night tells you the software ran. It does not tell you the right folders were included, that the copy opens, or how long getting it back would take. The NCSC’s advice for small organisations is to know how to restore your data and to check the backup contains all your important data. Thorough testing is uncommon in general: the government survey found that only a minority of organisations test their incident response plans thoroughly.

A useful test is small and regular:

1. Pick something specific: a single file from three weeks ago, one person’s mailbox, a whole laptop.
2. Restore it somewhere harmless, and time how long it takes from start to finish.
3. Open what came back and check it is complete.
4. Write down the date, what you restored, how long it took and anything that surprised you.

Compare the time against the number you settled earlier. If the laptop took a day to rebuild and your answer was two hours, you have found the gap while it costs nothing. Rotate what you test so that, over a year, every important system has been restored at least once.

When downtime is also a data breach.

Many owners assume a data breach means stolen data. The ICO’s definition is wider. A breach includes loss of availability, and its ransomware guidance states that temporary loss of access is also a type of personal data breach. If your client records are locked away, that can count, even if nobody outside the business has seen them.

Three duties follow from that:

• You must report it to the ICO within 72 hours of becoming aware of it where feasible, unless you can show it is unlikely to put people at risk.
• You should record every breach, including the ones you decide not to report.
• You must be able to restore access to personal data in a timely manner after a physical or technical incident, and have a process for regularly testing that your measures work.

The last one is the law describing a tested backup and a recovery plan. This is general information rather than legal advice, and the ICO’s own guidance is clear and readable if you need the detail.

The plan, on one page.

A continuity plan for a small business does not need to be a binder. It needs to be short enough that someone will use it under pressure, and stored somewhere that still works when your systems do not. The NCSC’s response guidance reminds businesses that your normal means of communication may be disrupted, so keep a printed copy and one on a phone.

What goes on it:

• What matters: each system, in the order it comes back, with the two numbers for each.
• Who decides: one person declares that this is an incident rather than a glitch, and has authority to spend money fixing it. Name a deputy, because the NCSC advises shared responsibility so there is cover when someone is away.
• Who calls whom: your IT support, your internet provider, your web host and your cloud services, with account numbers and phone numbers written down. The NCSC suggests checking these details every couple of months.
• Who tells people: staff first, so they stop guessing. Then customers and suppliers, with a few lines drafted in advance for “we are open, but slower today”.
• How you keep working: which tasks can carry on by phone or on paper, and who can work from home if the office is the problem.
• Who keeps the log: a running note of what happened and when, which is also your record for the ICO if personal data was involved.

Then rehearse it. The NCSC’s Exercise in a Box is free and does not need an expert to run. An hour around a table, walking through “the server has died, what now?”, will show you which names are out of date and which steps nobody understood.

Where to start.

1. List what the business runs on: every system, where its data lives and who looks after it.
2. Settle the two numbers for each one.
3. Check the copies. You want at least one off site and one disconnected or protected from changes, covering cloud data as well as anything in the office.
4. Restore something this month and time it. Then put the next test in the diary.
5. Put the plan on paper, give a copy to everyone named on it, and walk through it once a year or whenever staff, suppliers or systems change.

None of it needs new equipment to start, and the first test restore will show where the gaps are.