Plan backups around recovery needs

Learning edition: 5 October 2026. Introductory learning material.

Decide how much data loss and downtime each critical process can tolerate. Use those decisions to set backup frequency, retention and recovery priorities rather than choosing a universal daily or weekly schedule.

CISA recommends protected offline backups and regular restoration testing. Protect backup access and encryption keys, and ensure an incident affecting production systems cannot easily destroy every recovery copy.

Activity: Select one critical system. Record what is backed up, who checks it, the last successful restoration test and the time needed to restore useful service.

Reference: CISA StopRansomware Guide. Check the source and your system provider’s current instructions before implementation.

Recovery does not reverse disclosure

Restoring a backup can help recover availability, but it cannot retrieve information an attacker already copied. Include suspected data exposure in the incident response: the authorized response team should assess the affected information, preserve evidence and coordinate containment and any required notifications with appropriate advisers. Do not assume that restored files mean an incident is closed.