School backup and recovery: prove you can restore

Start with the service, then identify its data

Ask the owner of each important school service what would be needed to run it after a serious failure. A file copy may be only part of the answer. Attendance, safeguarding, finance and teaching systems can depend on accounts, configurations, encryption keys, integrations and working devices as well as their main databases.

Create a recovery register with the service, responsible owner, data location, backup arrangement and restoration method. Include cloud services. A supplier's promise that its platform is resilient is different from a promise to recover the school's accidentally deleted records or a compromised account.

For each service, agree two plain-language targets: how much recent work could reasonably be lost and how long the school could operate without it. These are planning decisions to discuss with school leaders, not numbers for IT support to invent in isolation. They shape backup frequency and recovery priorities.

Understand what the available copies protect

The DfE Cyber Security Hub describes the 3-2-1 approach: multiple copies, more than one storage arrangement and an off-site copy. It also emphasises separation from the live environment and testing recovery. Use these ideas to examine the actual failure scenarios rather than counting copies on a diagram.

A synchronised folder may rapidly reproduce an accidental deletion or unwanted change. Version history can help, but its retention, permissions and recovery process need checking. A backup accessible through the same compromised administrator account may be exposed at the moment it is most needed.

Ask IT support to explain which copy remains available if the main account, local network or building becomes unavailable. Where immutability or offline protection is claimed, ask what is protected, for how long and who can change that protection. Avoid assuming that a marketing label answers those questions.

Agree responsibility with every supplier

For hosted systems, request a clear division of responsibility. Establish who schedules backups, notices failures, requests a restoration and validates the recovered information. Ask whether restoring one school, one record or one point in time is possible, and what cost or lead time applies.

Include the end of the contract. Determine what exports the school can obtain, whether attachments and audit history are included and how those files could be read later. An export that nobody can interpret may not meet the school's continuity needs. Coordinate retention decisions with the data protection lead.

Keep recovery instructions and essential supplier contacts accessible if the normal school account cannot be used. Protect that information appropriately, and test access with the people who would actually respond.

Test a restoration that resembles real use

Choose representative tests, not just the easiest file to restore. One exercise might recover a deleted document; another could rebuild a service in an isolated environment and confirm that authorised staff can use it. Include permissions, attachments and integrations where they are important.

Record the backup date used, time required, errors encountered and checks performed by the service owner. A technician confirming that files exist is not the same as the finance team confirming that a restored dataset is complete and usable. Avoid exposing live pupil information in an uncontrolled test environment.

Plan tests so they do not overwrite production information or interrupt lessons. Competent IT support should choose a safe method and establish a rollback route. The purpose is to discover problems before an emergency, with enough evidence to fix them.

Plan the school day during recovery

Identify manual arrangements for essential operations. These may include attendance, emergency contacts, parent communications and a limited teaching fallback. Make sure those arrangements remain appropriate for confidentiality and safeguarding; copying every sensitive record onto unprotected memory sticks is not a continuity plan.

Decide how work created during the outage will be reconciled after systems return. Duplicate payments, contradictory attendance changes or missing notes can become a second incident if nobody owns the merge. The NCSC's recovery guidance highlights the importance of dependencies and integrating information produced during disruption.

Turn the results into a maintained plan

Keep a small action list with owners and dates after each test. Review the arrangement when a system changes, new data is introduced or responsibility moves to another supplier. Track failed backup jobs and repeated recovery problems instead of accepting a permanent warning state.

Connect this work to the incident response plan and school cyber security priorities. The evidence school leaders need is straightforward: what is protected, what remains exposed, when recovery was last demonstrated and which improvements are still required.