Australian cloud for business software — built and run in Sydney since 2003

+61 2 8282 5656
support@netleverage.com
Talk to an engineer
Talk to an engineer
NetLeverage
NetLeverage

A minimum recovery plan for a small business with no IT staff

Technical article
Backup & Recovery

Originally published:

About this article: AI-assisted writing, reviewed against the cited sources. This is source research, not lab validation. Check the stated versions and your own requirements before making changes.

A small business often runs on a few laptops, an email service, a cloud drive, an accounting package and a website someone else built. There is no IT department. When something goes wrong, the owner is the one who has to decide what to do, usually under pressure.

This guide is for owners and managers of small businesses without IT staff. It uses the Australian Signals Directorate's (ASD) Small business cyber security handbook, published in October 2026, and ASD's small business pages to build a short, written recovery plan. It assumes no technical background.

Why it matters

ASD's handbook is plain about the stakes: "Without reliable backups, it may be difficult or impossible to recover information after a cyber incident." On ransomware it adds: "Without reliable backups, recovering encrypted files may be difficult or impossible."

It also places backups among the first three things to do: "As a starting point, we recommend the following three measures: · Turn on multi-factor authentication · Keep your software up to date · Regularly back up your data".

A plan written before an incident means you make the hard decisions while calm (our reading). ASD makes the same point: "When an incident occurs, having a clear plan allows staff to act quickly instead of deciding what to do in the moment."

What a minimum plan covers

In our recommendation, a minimum plan fits on two or three pages and covers five things:

  1. Where your important information lives.
  2. How each part is backed up.
  3. Who to call and in what order.
  4. What to do in the first hour.
  5. How and when you test it.

Each is explained below.

Step 1: List where your information lives

ASD asks: "Think about all the places where your important information is stored. Are these locations included in your backup plan? For example, information held in your email or cloud accounts."

Write a simple list (our recommendation):

  • Computers: each laptop or desktop, and who uses it.
  • Email: the provider and which accounts matter.
  • Cloud storage: shared drives and folders.
  • Business software: accounting, point of sale, bookings, customer records.
  • Website: who hosts it and who can change it.
  • Phones: anything stored only on a phone, such as photos of job sites or two-factor apps.

ASD notes the cost of spreading data out: "Data stored across numerous devices or services increases the number of systems you have to keep secure and backed up." Its advice: "Where possible, store your business data in a central location that is secure and backed up regularly."

Step 2: Answer ASD's six backup questions

The handbook says to "Create a plan or procedure for backing up your business. This will be different for every business." It lists the questions the plan should answer:

  • "What data is or is not backed up?"
  • "When do backups occur?"
  • "Where are the backups stored?"
  • "Who is responsible for managing the backups?"
  • "How long are the backups kept for?"
  • "How often are the backups tested?"

In our recommendation, write one line for each item on your Step 1 list against these six questions. A table works well. Any blank cell is a gap.

ASD adds that "Backups should be done regularly or automatically as part of normal business operations." Automatic backups remove the need to remember (our reading).

Step 3: Keep a copy away from your main systems

ASD's ransomware advice is specific: "Regular backups that are tested and stored separately from your main systems are one of the most effective ways to reduce the impact of a ransomware attack."

An external drive connected while an authorised backup runs and stored securely afterwards can provide a separate copy (our recommendation). ASD mentions an external hard drive, but the product name matters: Microsoft's current Windows Backup app focuses on personal Microsoft accounts and synchronises selected folders to OneDrive; work or school accounts are not supported. It is not the external-drive method described here.

For selected Windows files, Microsoft documents File History backing up default or custom libraries to an external drive or network location. Add required folders to the appropriate library and verify coverage. File History is a file/version recovery tool, not a whole-system image or proof that every business application/database is protected. Use a supported application-aware or system backup method for needs outside its scope, with help from a qualified provider.

A cloud drive that syncs instantly is convenient but may copy deletions or encrypted files too (our understanding). Pair it with a copy that does not change automatically.

Step 4: Ask your providers how they back up

Much of a small business's data sits with providers. For a website host, ASD suggests asking: "How do they back up data? Check if the provider performs data backups, and how often. Storing backups offsite is a more secure method. Make sure you know where and how they store backups."

In our recommendation, ask the same question of your email, accounting and booking providers, and write down the answer, including how you would request a restore and how long it takes. ASD also advises that you "back up your website regularly so it can be restored after an incident."

Step 5: Write down who to call

ASD says to "Develop a plan that includes key contacts and response steps, and review and test it regularly." Its emergency plan should outline "who to contact for support (such as IT providers or your bank)" and "how the business will continue operating if critical systems are unavailable."

A minimum contact list (our recommendation):

  • Your outside IT helper, with an after-hours number.
  • Your email, website and accounting providers' support lines.
  • Your bank's fraud line.
  • Your insurer, if you have cyber cover.
  • The Australian Cyber Security Hotline. ASD says: "All cyber security incidents should be reported through the ReportCyber portal or by calling 1300 CYBER1 (1300 292 371)."

If customer personal information may be involved, ASD notes that "Businesses covered by the Privacy Act 1988 must report eligible data breaches to the Office of the Australian Information Commissioner (OAIC)."

Step 6: Keep the plan on paper

ASD says "a copy of the plan should be available offline in case systems are inaccessible." In our reading, a plan saved only on the computer that has just been encrypted is no plan at all. Print it, and keep a copy at home.

Step 7: Decide the first hour

ASD's advice for a suspected infection: "If you suspect a device has been infected, disconnect it from the network and seek assistance from an IT professional as soon as possible."

A minimum first-hour list (our recommendation):

  1. Disconnect affected devices from the network and Wi-Fi; do not switch them off unless your IT helper says to.
  2. Do not plug in your backup drive.
  3. Call your IT helper.
  4. If money or payment details may be involved, call your bank.
  5. Report through ReportCyber or 1300 CYBER1.
  6. Write down what you saw and when.

Step 8: Protect the accounts behind your backups

A backup is only as safe as the account that controls it (our reading). If someone takes over the email or cloud account that runs your backups, they may be able to delete them as well. ASD's handbook says "Businesses should enable multi-factor authentication (MFA), use passkeys, use strong, unique passwords across all systems and accounts, and apply security patches as soon as possible."

In our recommendation, add to your plan:

  • which accounts can delete or change backups;
  • that each has multi-factor authentication turned on;
  • where recovery codes are kept, on paper, away from the computer.

Personal information deserves the same care. ASD notes that "Regular backups allow businesses to recover personal data if it is lost, damaged or encrypted by ransomware." A backup holding customer details needs protecting as carefully as the original (our understanding).

Keep the plan current

A plan written once and filed away goes stale. ASD advises that you "Update contact details and systems as the business goes through changes" and "Incorporate lessons learned from past incidents or near misses."

In our recommendation, review the plan when you change provider, buy or retire a computer, or lose a staff member, and at least once a year otherwise. Put the review date on the front page.

Read-only checks

These checks only inspect files and records; they change nothing. This Windows PowerShell example lists a small sample of files by modification time on the example E: drive. It is a partial file inventory, not evidence of when a backup job succeeded or which restore points are usable:

$inventoryErrors = @()
Get-ChildItem -Path 'E:\' -Recurse -File -ErrorAction Continue -ErrorVariable +inventoryErrors |
  Sort-Object LastWriteTime -Descending |
  Select-Object -First 5 FullName, LastWriteTime
if ($inventoryErrors.Count -gt 0) {
  Write-Warning "Partial inventory: $($inventoryErrors.Count) access or enumeration error(s); review the errors above."
}

LastWriteTime is file modification time and may preserve an old source date. Review any reported errors or skipped paths. Establish backup freshness from the tool/provider's successful-run record, the identity of the protected output and its dated restore-point list, then test a known sample from that point. File dates alone establish none of those facts. Then review:

  1. Last successful protected point for each listed item, supported by its job record and restore-point list; record any gap or failed job.
  2. Blank cells in your six-question table.
  3. Contact list: are the numbers current?
  4. Paper copy: does it exist, and where?

These checks describe the recorded protection and any inventory gaps. A separate restore of a known sample checks only that sample at the selected point; it does not prove every file, the whole computer or a business application can be recovered.

Safe restore rehearsal

ASD advises that you "Run simple drills periodically" and "Refine the plan based on test results." A small restore test (our recommendation):

  1. Pick a synthetic or approved non-sensitive file with a known expected version, and identify its successful backup point from the tool/provider records.
  2. Restore it to a new, empty folder, not over the original.
  3. Open it and compare it with the expected version at that backup point. Record the achieved point and any loss relative to what the business needs.
  4. Time how long it took, including finding instructions.
  5. Ask each provider for a test restore of one item, if they offer one, and note the time.
  6. Update the plan with anything you learnt.

Diagnosing what you find

  • The last successful backup point is older than required: inspect the tool/provider's job and restore-point records for failed jobs, disconnected storage, schedule or account changes. Do not diagnose this from file modification dates.
  • The file will not open: the backup is incomplete; the software that made it is needed to read it; or the file was already damaged when copied.
  • Nobody knows how to restore: instructions were never written; only one person knew; or the provider's process was never asked about.
  • A provider cannot say how long a restore takes: restores are not part of the service; they are charged separately; or the request goes through a general queue.

Worked example (illustrative)

In this invented example, a four-person design studio lists cloud client files, hosted invoices and old project files on a laptop. It finds that the laptop's selected project folders have no protected copy. With suitable help, the owner includes those folders in File History's library coverage and uses a protected external drive, confirming a completed copy before disconnecting and securely storing it. In a hypothetical isolated test, one synthetic project file is restored to a new folder and matches the known version at the recorded point; the instructions and measured time would be recorded in the plan. That sample says nothing about whole-system or application/database recovery, which remain separate requirements. The test and its duration are not claimed as observed by the author.

Risks and limits

  • This is a minimum plan; businesses with more systems or regulated data will need more.
  • ASD's guidance is general and may be updated; check cyber.gov.au for the current version.
  • Provider restore options vary; only the provider can confirm theirs.

Sources

All accessed 14 November 2026.

Related future topics

  • Choosing an outside IT helper for a small business
  • Backing up a small business website
  • Two-factor apps on phones and recovery codes

This article was originally published on .