In this guide
List the recovery purposeSeparate record classesProtect the backup relationshipReview inclusion and retentionA backup should protect the information the operation genuinely needs to recover. Start by identifying case records, purchase evidence, current account maps and necessary business documents. A backup is not a reason to retain every obsolete screenshot or export indefinitely.
List the recovery purpose
Ask what would be needed if the working device failed or access to a file was lost. NCSC guidance recommends backing up important business data and understanding how to restore it. Use the actual storage provider’s supported features and security controls rather than assuming a synchronised folder covers every recovery scenario.
Separate record classes
Purchase evidence, case summaries and protected credentials can require different systems and access. Keep secrets in their intended protected store and use non-secret references in ordinary records. A backup plan should identify where each class belongs without collecting every value into one widely accessible document.
| Record class | Recovery question |
|---|---|
| Purchase evidence | Can the order and receipt be found? |
| Open cases | Can the next action and owner be identified? |
| Account map | Can the correct provider route be located? |
| Protected credentials | Does the supported secure recovery process work? |
Protect the backup relationship
Review who can access the backup and how its account is secured. Follow the provider’s current guidance for authentication, sharing and device access. Do not assume that a backup is less sensitive because it is used infrequently. It can contain the same customer information as the working copy.
Review inclusion and retention
Check that important records are included and unnecessary duplicates are not spreading. Define the real retention and disposal approach for the organisation’s obligations. Record a maintenance trigger such as a new case tool or changed storage provider. This guide does not prescribe a universal backup schedule or claim a completed restore test.
Questions about this guide
Is copying every support chat into another account a backup plan?
It may create another sensitive copy without defining recovery, access or retention. Identify the records actually needed and use supported backup or export features appropriately. Preserve the relevant evidence without turning a personal account into an uncontrolled archive.