Backup
A backup is a copy of your information saved to another device or to cloud storage, so you can recover it if the original is lost. Backing up is not a technical requirement of Cyber Essentials and no question assesses it, but Requirements v3.3 highly recommends it in section C.
- Term
- Backup
- Also known as
- Backing up, Data backup
- Category
- Malware, cloud and threats
- Requirement area
- C. Backing up your data
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term backup mean in Cyber Essentials?
A backup is a copy of your information saved to another device or to cloud storage, so you can recover it if the original is lost.
Backing up means creating a copy of your information and saving it to another device or to cloud storage (online).
How does backup apply to Cyber Essentials?
In plain terms
A backup is the spare set of house keys you leave with a neighbour. You hope never to need it, but when the originals are lost you are back inside in minutes instead of waiting for a locksmith. For a business the keys are your files, email and accounts data, and the neighbour is a separate drive or a cloud service.
What Cyber Essentials asks
Section C of the requirements opens: "Backing up your data is not a technical requirement of Cyber Essentials." It then recommends it strongly and gives practical advice:
- "Backing up regularly means you will always have a recent version of your information saved. This will help you recover quicker if your data is lost or stolen."
- "If automatic backups are available, you should consider turning them on."
- "If you back up your information to a USB stick or an external hard drive, disconnect it from your computer when a backup isn’t being done."
The v3.3 "what's new" list includes "Importance of backing up data is emphasised". No Danzell question asks about backups, so a missing backup cannot fail an assessment.
What good looks like
- Automatic, regular copies of the data that matters, including cloud data such as email and shared files.
- At least one copy that is disconnected or kept separate, so ransomware that reaches your network cannot reach the backup as well.
- An occasional test restore, so you know the copy works.
See does Cyber Essentials require backups?. Related: malware, cloud service.
Related terms
- RansomwareRansomware is malware that locks or scrambles your files so you cannot open them, then demands payment to unlock them.
- MalwareMalware is software that someone has written and spread on purpose to cause harm, such as computer viruses, worms and ransomware.
- Cloud serviceA cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data.
- Commodity attacksCommodity attacks are cheap, widely available attacks, run with off-the-shelf tools against many organisations at once, looking for anyone with an easy weakness rather than targeting you specifically.
- EDR (endpoint detection and response)Endpoint detection and response (EDR) is security software on each computer that records activity, spots suspicious behaviour and helps someone stop an attack.
- EncryptionEncryption is scrambling information with a secret key so that only someone holding the right key can read it.
Frequently asked questions
A backup is a copy of your information saved to another device or to cloud storage, so you can recover it if the original is lost. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
Backup relates to C. Backing up your data in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.