Business continuity and backup for UK SMEs: a practical checklist

If you ask a Surrey business owner what their backup and business continuity strategy looks like, they’ll probably describe an external drive, a cloud backup running overnight, or “Microsoft backs us up.” That’s not a business continuity strategy. It’s one component — and it’s not tested.

Business continuity and backup are essential for every small business, but they serve different purposes. Backup means having copies of your data in a place the primary system cannot reach. Business continuity is the plan that keeps your business running — or recovers quickly — when something goes wrong. You cannot have one without the other, but most SMEs have neither to the standard insurers and clients expect.

This checklist is what you need in place — whether you manage your IT in-house or use an external provider. It is based on guidance from the National Cyber Security Centre and reflects what a sensible, defensible setup looks like for a 10–25 seat SME.

Backup strategies: what works for SMEs

The NCSC’s Small Business Guide states that up-to-date backups are the most effective way of recovering from a ransomware attack. That does not mean backup prevents an attack — it means backup is the most reliable recovery path when prevention fails. A defensible backup setup needs three things:

Independent storage. Your backups must live outside your primary environment. A backup stored in the same Microsoft 365 tenant, controlled by the same credentials, and subject to the same ransomware propagation path offers limited protection against a tenant-wide compromise. Third-party backup solutions — separate from your M365 provider — are the baseline expectation for any business handling client data.

Ransomware resilience. Modern attacks specifically target backups. Your backup solution should include immutable or isolated copies that cannot be encrypted or deleted by ransomware. At minimum, ensure your cloud backup service retains previous versions that cannot be immediately overwritten.

Documented restoration. A backup is only useful if it works. You need to know — and be able to show your insurer — that you can actually restore from your backups when needed.

Not every SME needs the same approach. For a typical Surrey or Leatherhead SME, a sensible starting point is:

Daily automated file backup to a third-party cloud service separate from Microsoft 365. Daily backups align with most SMEs’ RPO targets — losing less than a day’s work is an acceptable risk for most businesses.

Email backup as a separate component, since most SMEs rely on email for client communication and regulatory records. Most backup platforms include this.

Database and application backup verified with your provider — manual export and import are not reliable strategies.

For a practical walk-through of how these components fit together, see our business continuity and backup hub, which covers the full range of tools and approaches available.

Business continuity: the plan that keeps you trading

Backup protects your data. Business continuity protects your ability to trade. The two are related but distinct.

A practical business continuity plan for an SME does not require a 40-page binder. It requires clarity on four operational questions:

What can we not do without? List your critical functions — email, file storage, your line-of-business application, phone system, website — and rank them by priority. Not every system is equally important. Deciding which ones matter most is a management decision, not an IT one.

How quickly must each come back? This is your Recovery Time Objective — how long you can afford to be without each system. Critical systems (email, collaboration tools) often need restoring within hours. Less critical items may wait until the next day. Write these targets down.

How much data can we lose? This is your Recovery Point Objective — the gap between your last good backup and an incident. Your RPO determines how frequently you must back up.

Who decides and who acts? Name an incident commander and a deputy. Document an escalation tree with mobile numbers — not office extensions, because your systems may be the thing that’s down. Specify who communicates with clients, staff, insurers, and your MSP.

If you need a ready-to-use starting point, download our business continuity plan template — designed for SMEs and structured around the four questions above.

The ten-item practical checklist

Here is a practical checklist that any SME in Surrey or Leatherhead can work through. Each item corresponds to something an insurer, a prospective client, or the Cyber Essentials scheme expects to see.

1. Backup strategy documented. What is backed up, where it is stored, how often, and how long copies are retained. Every SME should have this in writing — not a spreadsheet someone knows about, but a document you can pull up during an incident or an audit.

2. Backups stored independently. Third-party backup outside your primary environment. For M365 users, this means a dedicated backup provider, not Microsoft’s own retention features, which protect availability but not your data from malicious or accidental deletion.

3. Ransomware-resistant backup copies. Immutable or isolated backup storage that cannot be encrypted or deleted by ransomware. This is the single most important technical control your backup setup should include.

4. Named incident commander. One person with authority to declare an incident and make recovery decisions. One deputy who steps in when the commander is unavailable. This is not “the IT person” — it is a named individual.

5. Escalation tree documented. Who calls whom, in what order, during the first 15 minutes of an incident. Personal mobile numbers, not phone extensions. A copy kept offline — on a printed sheet or in a phone contact list that works independently of your systems.

6. Communication templates pre-written. Short, prepared messages for staff, clients, and suppliers in case of disruption. You should not be drafting messages to clients while your email is down.

7. Fallback communications channel. Something that works while Microsoft 365 does not — a WhatsApp group, alternative email addresses, or a shared document on a platform independent of your primary stack.

8. Alternative work location. Coworking space you can use, a triggered home-working policy, or a partner office you can access. For a 10–25 person business, losing your physical premises for even a day can be devastating without a fallback.

9. Insurance contact on the plan. Your insurer’s incident line and your policy number should be on the plan itself — not found separately when someone is under pressure.

10. A restore test completed this quarter. Documented, dated, with evidence of a successful restore. This is the single most common gap between SMEs who sleep well and SMEs who do not. The NCSC states you must test your backups so you know you can successfully restore data.

For Kent-based SMEs working through a similar checklist, this Kent-specific guide walks through the same principles with local context.

What business continuity costs to set up

For a typical Surrey SME with 10–25 employees, the annual costs are largely predictable:

Third-party backup for Microsoft 365 data typically runs between £2 and £5 per user per month. That is the cheapest line on the checklist and the one most SMEs overlook. Microsoft’s own retention features cover availability but not data recovery from malicious deletion or sync failures. An independent backup provider closes that gap.

A practical business continuity plan — one page, not a binder — can be developed in a single working session. The cost is time, not money.

The biggest recurring expense is alternative workspace. A monthly coworking arrangement in Surrey runs from £200 to £800 per seat. You do not need that capacity every day — just a triggered access agreement. Most Surrey businesses find they need it less than twice a year.

Total annual cost for a 20-seat Surrey SME: typically between £4,000 and £8,000 spread across backup services, insurance review, workspace arrangements, and the time to document the plan.

Why Surrey and Leatherhead SMEs should treat this locally

Business continuity must reflect how your business actually operates — your clients, your systems, your constraints. A Surrey law firm’s continuity needs differ from a Leatherhead manufacturing business, and both differ from a Brighton-based consultancy.

For SMEs in Surrey and Leatherhead specifically, local context matters. Your MSP’s response time, your insurer’s incident handling, and the practical recovery options available to you within commuting distance all affect how fast you recover. If you already use a local IT provider, they should be part of your escalation tree and familiar with your systems.

Geography also plays a role. Areas like Leatherhead, Dorking, and Reigate can experience prolonged disruptions during severe weather events that affect road access. Your continuity plan should account for scenarios where key personnel cannot physically reach their workspace for 24–48 hours. Having remote access procedures and alternative communications that work outside your office premises is the baseline expectation for Surrey-based SMEs.

How this connects to your IT Security Baseline

Business continuity and backup are two of the five pillars of a proper IT Security Baseline — alongside identity management, device standardisation, patching, and malware protection. You cannot have a secure environment without reliable backups, and you cannot prove you have a working security baseline if you cannot recover your data.

Cyber Essentials v3.3 (the Danzell update, in force from 27 April 2026) expects organisations to demonstrate backup and recovery capability. The scheme does not prescribe a specific continuity template, but it does expect evidence that you can recover your data when needed. A one-page continuity plan with named owners, tested backups, and documented communication contacts is the simplest form of that evidence.

If you have never defined recovery targets, tested a restore, or documented an escalation tree, you have a baseline gap. Not a fatal one — but a gap that insurance underwriters, client supplier questionnaires, and the Cyber Essentials assessment will all spot.

Many Surrey SMEs find they have partial backup coverage — an external hard drive for file shares, perhaps a third-party tool for M365 — but no documented continuity plan, no tested restore, and no named incident commander. It takes a single working session to bring these elements together.

What to do next

If this checklist has highlighted gaps — and most SMEs have at least two or three — the next step is to get an independent view of your current continuity and backup posture. A Security Triage Call gives you a clear picture of where you stand, what is working, and what needs fixing — before an incident forces you to find out.

Book a Security Triage Call

FAQs

Does Cyber Essentials require a business continuity plan?

No. Cyber Essentials focuses on technical controls — firewalls, secure configuration, access control, malware protection, and patch management. However, the scheme expects evidence that you can recover your data, and backup testing is part of that expectation. A documented continuity plan is the simplest way to evidence your recovery capability.

How often should we test our backups?

At minimum, test a restore quarterly — a single file restore is a quick check that confirms your backup is working. A full-system restore test should be performed at least once a year. Test after any major change to your environment, such as new systems, migrations, or staff changes.

What is the difference between RTO and RPO?

Recovery Time Objective (RTO) is how quickly you must restore operations after an incident — measured in hours or days. Recovery Point Objective (RPO) is the maximum amount of data loss you can accept, measured in time between the last good backup and the incident. RTO is about downtime; RPO is about data lost.

Does Microsoft 365 back us up?

Microsoft protects availability — the service stays running — but it does not provide a traditional backup for your data. M365’s retention features protect against accidental loss to some degree, but they do not protect your data from malicious deletion, sync failures, or a tenant-wide compromise. Independent third-party backup is the standard expectation.

Can we create a business continuity plan ourselves?

Yes. A practical plan for a 10–25 seat SME can fit on a few pages. The key is making it real — naming owners, writing contacts, testing a restore — rather than treating it as a compliance exercise. If you would like an independent assessment of your current plan, a Security Triage Call is the appropriate starting point.