Data Backup and Recovery Checklist

The uncomfortable truth about backups

Almost every business believes it has backups. Far fewer have ever restored from one. The gap between those two states is where businesses are lost — to ransomware, to a deleted mailbox, to a cloud account closed in error. Backup is also a headline control in the ACSC's Essential Eight, which is a strong hint about how often it's the difference between an incident and a catastrophe. This checklist covers what to protect, how to structure the backups, and — the part everyone skips — how to prove recovery works.

Know what you're protecting

• List every place business data lives: accounting platform, email and calendars, shared drives, CRM, job management, website, and the laptops and phones where work actually happens.
• Include the cloud apps. Microsoft 365, Google Workspace, Xero and similar platforms are resilient, but their built-in retention has limits and their terms generally make your data your responsibility — check what each provider actually retains and for how long, and back up independently where it matters.
• Rank each system by how long you could operate without it and how much data you could afford to lose. These two answers (recovery time, recovery point) drive every other decision on this list.
• Flag data with legal weight: financial records the ATO requires you to retain, employee records under Fair Work rules, and personal information covered by the Privacy Act. Check the current retention requirements with each authority before setting deletion policies.

Structure the backups properly

• Follow the 3-2-1 principle: at least three copies of important data, on two different types of storage, with one copy off-site or in a separate cloud service.
• Keep at least one copy offline or immutable. Ransomware hunts for connected backups and encrypts them too. A copy that can't be altered from your network is your last line.
• Automate the schedule. Backups that depend on someone remembering are backups that stop the week that person is on leave. Frequency should match your recovery-point answer above — critical systems may warrant continuous or daily protection; archives, less.
• Encrypt backups in transit and at rest, and store the encryption keys somewhere that survives the disaster too.
• Separate backup credentials from everyday admin accounts, with multi-factor authentication. If one compromised login can delete both your systems and your backups, you don't have backups.

Test recovery — actually test it

• Do a test restore on a schedule, not just when you're worried. Restore a file, a mailbox, and periodically a whole system, and time it.
• Verify the restored data, not just the job status. "Backup completed successfully" and "the restored file opens and is correct" are different facts.
• Compare restore time against what the business can tolerate. If restoring the job system takes three days and you said you could survive one, the plan fails on paper — better to learn that now.
• Check alerts reach a human. Failed-backup notifications that go to an unmonitored inbox have caused more data loss than any storage failure.

Write the recovery plan down

• Document, step by step: what to restore first, where the backups and keys are, who does what, and who to call (IT provider, insurer, bank).
• Keep a copy of the plan outside the systems it protects — a plan stored only on the server it's meant to recover is a joke that writes itself.
• Include your breach obligations: if personal information is involved in an incident, the Notifiable Data Breaches scheme may require assessment and notification — the OAIC's current guidance sets out the process.
• Make sure at least two people can execute it. If recovery only works when one particular person is contactable, you've backed up your data but not your business — the same logic as the owner absence test.

Review on a rhythm

• Revisit this checklist whenever systems change — a new platform, a migration, a new integration — and at least annually otherwise.
• Add new data sources on day one, not when someone remembers.
• Keep evidence of tests and reviews. Insurers and enterprise customers increasingly ask, and a dated log is the easy answer.

Backup discipline is a classic case of back-office work that's nobody's job until it's everybody's emergency. Our operations page covers how to make this kind of quiet, critical routine actually happen every month.