Back up what you cannot afford to lose
A backup turns ransomware, theft or a dead laptop from a disaster into a bad afternoon, provided it is separate and tested.
Decide what matters
You do not need a copy of everything. List what you could not recreate: documents, photos, the accounts file, the customer list. These are usually a small part of what is on the device, which makes backing them up quick.
Keep one copy out of reach
Ransomware encrypts everything it can reach, including a backup drive that is always plugged in and a network folder that is always connected. At least one copy should be somewhere the device cannot write to: a drive that is disconnected after the backup, or a cloud service that keeps earlier versions of files.
Protect the cloud account that holds the backup with a second sign-in step. Otherwise the backup is only as safe as one password.
Test the way back
A backup that has never been restored is a hope. Once in a while, pick a file and restore it. You will learn whether the backup works and how long a real recovery would take.
This note is our own plain-language summary. For the full guidance, read the original: https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/backing-up-your-data
Next noteThe first hour after a mistake
A backup that is always plugged in gets encrypted with everything else.