Backup and ransomware restore test for UK SMEs (2026)

Why a quiet restore drill beats a backup icon you never click. Plain English for UK owner-managers.

Most small UK firms say they have backups. Far fewer have restored a file on purpose in the last quarter. The difference shows up on the worst Monday of the year: a laptop dies, a shared drive vanishes, or ransomware locks folders overnight.

This guide is for owner-managers with roughly 5 to 50 people and no dedicated IT team. It explains why restore tests matter, what the 3-2-1 idea means in plain English, what to back up first, how to run a short quarterly drill, and what to do if ransomware appears. It is practical hygiene, not a promise of full recovery and not fear theatre.

Why restore tests matter more than the backup logo

A backup is only useful if you can get the right files back in a useful time. Cloud sync is not the same thing. OneDrive or Google Drive can mirror a bad delete or a ransomware rename across devices if you do not notice in time.

A restore test answers four boring questions:

Do we know where the backup lives?
Can the right person sign in without ringing a leaver?
Can we pull back one real folder (accounts, contracts, project files) onto a clean machine?
How long did that take, and what blocked us?

Write the answers down. Insurers, Cyber Essentials assessors, and buyers often ask whether you test restores. A dated note from a quiet Friday is better than a confident shrug.

The 3-2-1 idea in plain English

People quote “3-2-1” as if it were a product. It is a rule of thumb:

3 copies of important data (the live copy plus two backups)
2 different types of storage (for example cloud backup plus an external disk you unplug)
1 copy offline or off-site so a single fire, theft, or ransomware wave cannot wipe everything

You do not need enterprise tape libraries. For many UK SMEs that looks like: Microsoft 365 or Google Workspace with retention or a proper backup product, plus a monthly offline copy of the finance archive, plus a named person who can restore.

Perfect 3-2-1 is less important than one tested path you can run without heroics.

What to back up first for a small UK firm

Start with work that would stop the business or create legal pain if it vanished:

Accounting exports and year-end packs (Xero/FreeAgent/Sage exports, not only the live login)
Customer and supplier contracts, proposals, and signed PDFs
Shared drives or SharePoint / Google Drive libraries the team actually uses
Email and calendar if you rely on Microsoft 365 or Google Workspace (confirm retention and whether you buy a third-party mailbox backup)
Password vault export / emergency kit stored safely offline (see OwnerSec’s password guides)
Domain, hosting, and banking recovery codes in the company vault, not in one person’s head

Phones matter if directors keep WhatsApp deals and photos of paperwork there. Laptops matter more if people save to Desktop instead of the shared drive. Pair backups with company-managed endpoint protection so malware is less likely to rewrite everything before you notice.

How to run a quarterly restore test

Block 60 to 90 minutes once a quarter. Pick a quiet slot. Use a spare laptop or a clean virtual machine if you have one. Do not restore over your only live copy.

Pick a target. One finance folder, one client matter pack, or one shared library. Write the path and the date you want to roll back to.
Sign in as the restore owner. If only a leaver’s personal cloud login works, fix that ownership this week.
Restore to a quarantine folder on a machine that is not your only production PC.
Open three files. A spreadsheet, a PDF, and something with images or macros if you use them. Confirm they open and look right.
Time it. Note start, finish, and blockers (forgotten MFA device, expired licence, wrong site selected).
File a one-page note. Date, who ran it, what was restored, time taken, pass/fail, and the next test date.

If the restore fails, the job is to fix the backup path, not to blame the calendar. Rerun within a fortnight.

Ransomware note (calm and limited)

If files rename themselves, open with strange extensions, or a ransom note appears:

Disconnect affected machines from Wi-Fi and Ethernet. Pause further spread first.
Do not wipe everything in a panic until you know you have a known-good backup path.
Restore from a backup you trust, ideally one that was offline or versioned before the incident.
Get advice from your IT provider, insurer helpline, or a specialist. Do not treat “pay the ransom” as plan A.
If the incident started with a phishing click, follow the containment steps in OwnerSec’s first-hour phishing guide in parallel (sessions, passwords, mailbox rules).

Paying a criminal does not guarantee unlock keys, and it can create further problems. Decisions about payment, insurers, and regulators need proper advice for your facts. This page is general information only.

After containment, some owners try file-recovery software on an isolated machine when a backup gap exists. That can sometimes recover deleted or damaged files. It is not a substitute for tested backups, and success is not guaranteed.

Common mistakes

Assuming cloud sync equals a restore-tested backup
Keeping the only “backup” USB plugged into the same PC all year
No named owner; the MSP login died with a contractor
Never restoring because “the green tick is on”
Backing up everything except the finance export everyone needs on day one
Skipping MFA and password hygiene, then hoping backups will save a hijacked mailbox (they will not stop invoice fraud on their own)

One-week owner checklist

Day 1: List the five data sets that would hurt most if lost. Name one restore owner.
Day 2: Confirm where each lives today (M365, Google, NAS, USB, MSP backup).
Day 3: Turn on version history / recycle bin retention where your cloud product allows it. Note gaps.
Day 4: Buy or confirm an offline or second-location copy for the finance archive at minimum.
Day 5: Run a small restore of one folder to a quarantine path. Time it. Write the one-page note.
Day 6: Fix whatever blocked the test (access, licence, wrong library).
Day 7: Diary the next quarterly drill. Tell leadership in one sentence that the restore path was tested.

Bottom line

Backups without restore drills are a story you tell yourself. For most UK SMEs in 2026, the win is a named owner, a short quarterly test, and a second copy that ransomware cannot quietly encrypt. Pair that with endpoint visibility and a clear first-hour plan after phishing. None of this makes you invulnerable. It makes the bad Monday shorter and more boring.