This is general educational guidance, not an assessment of your business or a guarantee of security. Check the original sources and your specific requirements before acting.
01
Decide what must be recoverable
Create a short list of critical systems and information, such as the website, booking records, business documents, accounting records and necessary configuration.
- Identify where each system is stored and who can restore it.
- Set a recovery priority, including what must return first to serve customers.
02
Keep recovery copies independent
If backups share the same compromised login or storage, an attacker might delete or encrypt them too.
- Keep a separately protected backup, ideally with offline or immutable protection when practical.
- Limit deletion privileges.
- Protect recovery credentials and emergency instructions.
03
Test the complete restore
Test the actual service, not just the ability to download a ZIP.
- Restore a sample in an isolated environment.
- Check the website opens, data is readable, and important functions work.
- Write down the test date, findings and time taken; fix any gaps.
Source notes
Read the original guidance
The links below are from the original publishers. This article is independently written by TASII and does not imply endorsement.
- Small business cyber security handbookASD’s Australian Cyber Security Centre · 7 October 2026
- Protecting devices, systems and networksASD’s Australian Cyber Security Centre · 7 October 2026
- Implement and test cyber security incident response plansASD’s Australian Cyber Security Centre · 7 October 2026
