Backups and Cyber Essentials: recommended, not required

Is backup a Cyber Essentials requirement?

No. Section C of the requirements opens by saying that backing up your data is not a technical requirement of Cyber Essentials. The scheme's five controls are about stopping an internet-based attacker getting in; backups are about recovering afterwards. That is why there is no A-section question on them and why a missing backup cannot fail an assessment.

What does the NCSC recommend?

The section is short and practical:

• Put an appropriate backup in place. Backing up means creating a copy of your information and saving it to another device or to cloud storage.
• Back up regularly so you always have a recent version, which helps you recover quicker if data is lost or stolen.
• If automatic backups are available, consider turning them on, so information is saved to cloud storage without anyone having to remember.
• If you back up to a USB stick or an external hard drive, disconnect it from your computer when a backup isn’t being done.

Why was backup emphasised in v3.3?

The v3.3 'what's new' list includes 'importance of backing up data is emphasised'. The NCSC does not give a reason in the document, but the requirements already use a ransomware example in the User Access Control section to explain admin separation, and the backup section says regular backups help you recover quicker if data is lost or stolen. The five controls reduce the chance of an attack succeeding; a tested backup limits the damage if one does.

What does a good backup look like for a small organisation?

Three copies of important data, on two different media, with one off-site or offline, is the common rule of thumb. For Microsoft 365 or Google Workspace users, that usually means a third-party backup of mailboxes and files as well as the platform's own retention. Test a restore at least quarterly and write down how long it took.