Businesses Urged to Strengthen Backup Strategies as Recovery Becomes the New Cyber Security Battleground

Businesses are being encouraged to review their backup and recovery arrangements as cyber security professionals warn that the ability to restore operations quickly has become just as important as preventing attacks in the first place. While organisations continue to invest in firewalls, endpoint protection and employee awareness training, advisers say many are placing insufficient attention on whether critical systems and data can actually be recovered following a cyber incident.

Industry assessments suggest that organisations are becoming more effective at detecting cyber attacks, but many still struggle to restore services within acceptable timescales. Security specialists report that businesses frequently discover weaknesses in backup arrangements only after an incident has occurred, when recovery procedures fail to operate as expected or essential data is found to be incomplete.

A spokesperson for the National Cyber Security Centre said resilience should be considered alongside prevention. “No organisation can assume it will never experience a cyber incident. Effective backups and tested recovery arrangements are essential components of reducing business disruption when an attack does occur.”

Information security consultants say common weaknesses include backups that are connected permanently to production networks, failure to verify that backup data can be restored successfully, and organisations relying on systems that have never been tested under realistic conditions. In some cases, businesses maintain multiple copies of data but are unable to recover critical applications because supporting infrastructure or configuration information has not been backed up.

“Many organisations measure success by whether a backup completed overnight,” said Andrew Collins, a cyber resilience consultant working with businesses across manufacturing, professional services and technology sectors. “The real question is whether the business could continue operating if its primary systems became unavailable today.”

The increasing use of cloud platforms has also altered the risk landscape. While many businesses assume cloud-hosted services are automatically protected, security advisers note that responsibility for backing up business information often remains with the customer. Organisations may find that deleted or corrupted data cannot be recovered indefinitely unless separate retention and recovery arrangements have been implemented.

Auditors have also identified gaps between business continuity planning and technical recovery capabilities. Organisations may have documented continuity plans, but limited evidence that recovery time objectives have been tested or that key business functions can be restored within acceptable timescales.

Commercial expectations are evolving in parallel. Customers, insurers and regulators are placing greater emphasis on operational resilience, with businesses increasingly being asked to demonstrate not only how they prevent cyber attacks but also how they would recover from them. Organisations unable to restore services promptly may face contractual consequences, reputational damage and prolonged operational disruption even where the original cyber incident is successfully contained.

In response, many businesses are strengthening cyber resilience by introducing offline or immutable backups, carrying out regular recovery exercises and aligning technical recovery plans with business continuity arrangements. Others are identifying critical information assets and prioritising recovery activities based on operational importance rather than technical convenience.

Collins believes the emphasis on recovery reflects a broader shift in information security. “Cyber security is no longer judged solely by whether an organisation can stop every attack. Increasingly, it is judged by how quickly and effectively the business can recover when something goes wrong.”

As cyber threats continue to evolve, resilience is expected to become an increasingly important measure of organisational capability. For businesses operating under information security frameworks such as ISO 27001, demonstrating that backup arrangements are secure, regularly tested and capable of supporting business recovery is becoming a key indicator of a mature and effective information security management system.

A message from our sponsors, The Ideas Distillery: 

If you would like to look at how to implement an ISO 27001 information security management system, then simply contact us.

Or, if you want to see what's involved in more detail, then get a completely free, no obligation, totally tailored ISO Gap Analysis for your business (only available to UK businesses).