by The Computing Australia Group | 
Sooner or later, every business loses data, whether through ransomware, a failed laptop, a deleted folder or a burst pipe. Your data backup and disaster recovery arrangements decide whether that day is a minor hassle or a full-blown crisis.
Backup means having copies of your data. Disaster recovery means knowing how quickly you can use those copies to get running again, and having proved it. This guide explains how to set up both, what has changed recently, and how to test that your plan really works. If you’re dealing with an incident right now, call our team on 1300 790 166.
Updated 5 November 2026
What’s changed since this was first published
- ASD Essentials published (15 Oct 2026). It succeeds the Essential Eight, where regular backups have long been one of the core controls. Review your backup approach as the new guidance rolls out.
- Ransomware payment reporting began (30 May 2025). Businesses with turnover above $3 million must report ransomware or cyber extortion payments to the ASD within 72 hours.
- Cybercrime costs keep rising (2024–25). The ASD puts the average self-reported cost at $56,600 for a small business and $97,200 for a medium one.
Why data backup and disaster recovery matter
The ASD’s latest figures put the average cost of a reported cybercrime at $56,600 for a small business, before you count lost sales and staff time. Yet attacks are only one way to lose data. In practice, the most common causes are everyday ones:
Ransomware
Attackers encrypt your files, and often your backups too, then demand payment.
Accidental deletion
Someone removes the wrong folder, or overwrites a file that mattered.
Hardware failure
Drives, servers and laptops fail, usually without warning.
Account compromise
A stolen password lets an attacker delete or encrypt cloud data.
Fire, flood and power
Physical damage can take out your office and everything in it.
Supplier outages
A cloud or software provider goes down, or loses data itself.
Backup vs disaster recovery: what’s the difference?
The two are often lumped together, but they answer different questions. A backup answers “do we still have the data?” Disaster recovery answers “how fast can we work again, and in what order?” In other words, you can have perfect backups and still be offline for a week if nobody knows how to restore them.
A quick test. If your main server or Microsoft 365 tenant disappeared this morning, who would do what first, and when would staff be working again? If nobody can answer clearly, you have backups, not a recovery plan.
The 3-2-1 rule, updated for ransomware
The classic rule still works, with two additions that reflect how attacks happen today:
- 3 copies of your data. The original plus two backups.
- 2 types of storage. For example, local disk and cloud.
- 1 copy offsite. So a fire or theft can’t take everything.
- 1 copy offline or immutable. A copy that can’t be changed or deleted, even by someone with admin access.
- 0 errors when you test. Regular restore tests prove the backups actually work.
The fourth point matters most. Ransomware operators often hunt for backups first, so at least one copy must sit beyond their reach, whether offline, immutable or protected by separate credentials.
Don’t forget your cloud data
Moving to Microsoft 365 or other cloud apps doesn’t move responsibility for your data. Under Microsoft’s shared responsibility model, Microsoft runs the service, but your data, accounts and access settings remain yours to protect. Recycle bins and retention settings help with small mistakes. However, they aren’t designed as an independent, long-term backup.
For this reason, many businesses add a dedicated backup for Microsoft 365, covering email, OneDrive, SharePoint and Teams, along with any other cloud apps that hold critical records. Our cloud services team can help you decide what needs covering.
Set your recovery targets
Before choosing tools, agree how much disruption each system can tolerate. Three measures do the job:
Recovery time objective (RTO)
How long a system can be down before the impact becomes serious. Email might be hours; an archive might be days.
Recovery point objective (RPO)
How much recent data you can afford to lose. If losing a day’s orders would hurt, nightly backups aren’t enough.
Maximum tolerable downtime
The point at which an outage threatens the business itself. Your plan must recover well inside it.
How to build a data backup and disaster recovery plan
A useful plan is short, practical and kept where people can find it during an outage. Build it in six steps:
List what matters
Identify critical systems and data, and who depends on them.
Set targets
Agree the recovery time and recovery point for each system.
Choose methods
Match backup frequency, storage and recovery options to those targets.
Write the runbook
Step-by-step recovery instructions, the order of recovery and key contacts.
Plan communications
Who tells staff, customers and your insurer, and which reporting duties apply.
Test and update
Run restore tests, fix what fails and update the plan after every change.
Reporting duties belong in step five. If personal information is involved, the Notifiable Data Breaches scheme may require you to notify the OAIC and affected people. In addition, if your turnover is above $3 million and you make a ransomware payment, you must report it to the ASD within 72 hours.
Test it, or it isn’t a plan
Untested backups are a hope, not a safeguard. As a sensible minimum, run a sample restore every few months and a full recovery test at least once a year, plus a check after any major system change. Meanwhile, a short tabletop exercise, where your team walks through a scenario, quickly shows gaps in contacts, passwords and decision-making.
Keep a record of each test: what you restored, how long it took and what needs fixing. Over time, that record becomes your proof that recovery targets are realistic.
How CAG helps with data backup and disaster recovery
Our disaster recovery service starts by making sure your backups and recovery plan actually work, then tests and updates them regularly so they stay effective. If disaster strikes, our Perth team in Belmont responds fast, and emergency response is available after hours for serious incidents.
Prevention matters just as much. Our cyber security services include 24/7 monitoring and endpoint detection and response with automatic containment, which can stop ransomware before it spreads. And if an incident needs investigating, our computer forensics team offers rapid response, evidence preservation and forensic reports.
Disaster recovery
Would your backups work tomorrow?
Talk to our team about testing your backups and recovery plan, before you need them.
Data backup and disaster recovery: common questions
How often should we back up?
It depends on how much data you can afford to lose. Many businesses back up critical systems several times a day and everything else at least daily.
Is cloud storage the same as a backup?
No. Sync services copy deletions and encrypted files as well. A backup keeps separate, versioned copies you can restore from.
Does Microsoft back up our Microsoft 365 data?
Microsoft keeps the service running, but your data remains your responsibility under its shared responsibility model. Many businesses add a dedicated Microsoft 365 backup.
Ransomware and testing
Can backups protect us from ransomware?
Yes, if at least one copy is offline or immutable and you have tested restoring from it. That way, you can recover without negotiating with attackers.
How often should we test our backups?
A sample restore every few months and a full recovery test at least once a year is a sensible minimum, plus a check after major changes.
What should a data backup and disaster recovery plan include?
Your critical systems, recovery targets, backup methods, a step-by-step runbook, contacts, a communications plan and a testing schedule.
Sources and further reading
- Australian Signals Directorate — ASD Essentials
- Australian Signals Directorate — Ransomware payment and cyber extortion payment reporting
- Australian Signals Directorate — Annual Cyber Threat Report 2024–25
- Microsoft Learn — Shared responsibility in the cloud
- OAIC — Notifiable data breaches
This article is general information, not legal advice. Last reviewed 5 November 2026.
About the author
Gordon Murdoch
Director (Policy, Compliance and Training), The Computing Australia Group
Gordon leads CAG’s policy, compliance and training work. He helps organisations turn security requirements into practical policies their teams can actually follow, and drives projects that use AI and other tools to lift efficiency and service quality. His view is simple: compliance should make a business stronger, not just tick a box.
