Planning backup media and restore tests for schools
Backup media should support a documented recovery plan. Capacity alone says little about whether the school could recover an essential service after data loss. Identify what must be restored, how quickly it is needed and who can perform the recovery, then choose and test the storage arrangements that support those needs.
Start with a recovery requirement
List the information and services that would disrupt teaching or administration if they became unavailable. For each, identify an owner, an acceptable recovery point and a practical restoration priority. Distinguish an independent backup from a working copy or synchronised folder, because changes and deletions may propagate through ordinary synchronisation.
Compare removable drives, other physical media and managed backup services against this plan. Check capacity, supported interfaces, retention needs and the availability of a working reader or recovery system. A box of media is of limited value if the school no longer has the equipment or instructions needed to read it.
Protect the backup and its recovery details
The DfE cyber security standard calls for protected backup arrangements and recorded restore testing. Have the IT lead confirm how the selected design addresses isolation, access, off-site protection and the recovery of essential data. Keep these responsibilities explicit when a service provider manages the process.
For removable media, create a labelled rotation record that identifies the backup date without exposing sensitive contents. Agree authorised handling, secure storage and any required encryption through the school’s data and security policies. Store recovery keys and instructions through an approved process that remains available if the main system is unavailable.
Test a useful restoration
Choose a realistic example, such as recovering a departmental folder with its expected structure and access permissions into a controlled test location. Check the contents with the data owner, record the duration and note any missing steps. A successful backup-job message alone does not demonstrate that this restoration will work.
Review failures, media age and changes to systems. Retire unreliable media through an approved disposal process and update the recovery instructions when equipment or staff change. Use the IT budget planner to include replacement media, service charges and testing time in the annual plan.
Action checklist
- Identify recovery priorities before choosing capacity.
- Confirm how backups are protected from the primary system.
- Keep authorised handling and recovery instructions clear.
- Record a realistic restore test and its outcome.
Common questions
Does a successful backup message prove the school can recover?
It is useful evidence that a job ran, but a restore test is needed to establish that the required information can be recovered and used.
Sources and scope
Source titles are provided for reference. Check the current original guidance and your school's circumstances before making a policy or compliance decision.
- Schools Direct editorial — Original school resource planning guidance and worked examples. Checked 1 November 2026.
- Department for Education — Meeting digital and technology standards: cyber security core standard. Checked 1 November 2026.