Technology & cyber security
Backups your business can actually restore
A backup only helps when it contains what you need and you can restore it after a lost device, mistake or cyber incident.
- Last reviewed
- Reading time
- 2 min read
Quick answer
List the records and systems needed to trade, choose a protected backup method, set a schedule and test restoring a sample. Record who can do it if the usual person is unavailable.
Imagine the computer holding your orders fails on Monday morning. Can you see who is expecting a delivery today? Can you issue invoices and pay staff? A backup plan starts with those practical questions, not with a product name.
Decide what must be recovered
List the records and systems you need to operate: customer orders, accounting files, contacts, email, website content, staff schedules and any specialist software. Note where each lives and who has access. A retail shop may need point-of-sale records and supplier contacts immediately; old marketing photos may wait a few days.
Choose how much recent work you can afford to lose. If losing a week’s bookings would be serious, a weekly backup is unlikely to be enough. Also estimate how long the business can operate without each system. These answers shape your schedule and recovery plan.
Protect the copy
Automate backups where practical and keep at least one copy protected from the same failure that could damage the original. A synced cloud folder may faithfully sync an accidental deletion, so check whether older versions or a separate backup are available. Protect backup accounts with multi-factor authentication and limit who can delete copies. The Australian Cyber Security Centre’s guidance explains the core steps.
Test a restore
Choose a non-sensitive test file or a safe test environment. Restore it and check that it opens correctly. For critical systems, ask your IT provider how to test the full process without interrupting trading. Record the date, time taken, missing items and who performed the test. A message saying “backup complete” is not proof that you could reopen tomorrow.
For example, a small clinic discovers during a test that its appointment database is copied, but the application settings needed to read it are not. Finding this out on a quiet Friday gives the team time to fix the plan before an incident.
Keep contact details and recovery steps somewhere the team can reach if the main system is unavailable. Review the plan after changing software or locations, and include it in the annual business review. The business insurance guide explains different kinds of risk, but a policy does not replace recoverable records.
Important things to know
- A backup and a working restore process are separate things.
- Test access and recovery without exposing customer or employee data.
- If a cyber incident is happening now, seek specialist help and use the ACSC’s current reporting and support guidance.
Official resources
- Small business cyber security guide — ACSCcyber.gov.au
Related guides
Cash flow
What are the warning signs of cash flow problems?
Late customer payments, paying suppliers late, falling behind on tax or super and using personal money to keep going are common early warning signs. Acting early gives you more options.
4 min read
Running a business
What type of accountant or adviser does my business need?
A bookkeeper keeps your records, a registered BAS agent handles your BAS, a registered tax agent handles tax, and an accountant helps with the bigger financial picture. Titles like business accountant or CFO describe a role, so check the registration or membership behind the title.
9 min read
Put this into practice
Sources
- Small business cyber security guide, Australian Cyber Security Centre (accessed 2 Oct 2026)
- How to back up your files and devices, Australian Cyber Security Centre (accessed 2 Oct 2026)
Last reviewed 2 Oct 2026. We review this guide regularly and when official guidance changes.