Most small businesses have some kind of backup. Far fewer have checked whether that backup would survive a ransomware attack. Modern ransomware gangs don’t just encrypt your files. They go looking for your backups first, because a business that can restore its data has no reason to pay. This guide explains what ransomware-resistant backups are, why they matter for UK SMEs right now, and the practical steps that make recovery realistic.
Key takeaways
- More than half of the ransomware attacks reported to police between April 2025 and March 2026 hit SMEs.
- Attackers go after backups first, so at least one copy must be out of reach of everyday user and admin accounts.
- The NCSC advises not relying solely on cloud version history or recycle bins.
- Test restores regularly and agree your incident plan before you need it.
Why ransomware is an SME problem
It’s easy to assume ransomware only hits large organisations. The police figures say otherwise. In June 2026 City of London Police reported that 323 organisations reported a ransomware attack between April 2025 and March 2026, and that more than half of those reports (175) came from small and medium-sized businesses. Police also warned that the real number is likely much higher, as many attacks go unreported.
The official advice is clear: don’t pay. The NCSC and UK law enforcement do not encourage or condone ransom payments, and paying gives no guarantee you’ll get your data back. That makes a backup you can trust the single most important part of your recovery plan.
What makes a backup “ransomware-resistant”?
A traditional backup protects you against a failed hard drive or an accidentally deleted folder. Ransomware is different, because the attacker is often inside your network with admin rights. If your backups are reachable from the same accounts and systems, they can be deleted or encrypted along with everything else.
The NCSC’s guidance on ransomware-resistant backups sets out the features a resilient backup system should have. In plain English, the key ideas are:
- Resilient to destructive actions: backups shouldn’t be easy to delete or overwrite, even by someone with admin access.
- Multiple restore points: you should be able to go back to an earlier version if the most recent backups were taken after the infection started.
- Encrypted, with well-managed keys: backup data should be protected, and the keys kept safe.
- Alerts on unusual activity: you should be warned about unexpected changes or privileged actions, such as someone trying to shorten retention or delete backup sets.
- Isolation: on-premises backup systems should be separated from the rest of your network and kept patched.
Don’t assume the cloud has it covered
Many businesses now work mainly in cloud services such as Microsoft 365. Version history and recycle bins are useful, but the NCSC advises that you shouldn’t rely solely on these mechanisms. Its advice is to make sure essential data is exported and backed up, to keep an independent copy in another safe place or service, and to know how you would restore it before you ever need to.
Five practical steps for your business
1. Know what you need to recover
List the data and systems your business can’t operate without: email, shared files, finance and line-of-business applications. Decide how much data you could afford to lose (an hour? a day?) and how quickly you’d need to be back up and running.
2. Keep at least one copy out of reach
Make sure at least one backup copy is separated from your everyday systems and accounts, so a compromised user or admin login can’t reach it. Immutable or “locked” storage that can’t be changed for a set period is one good way to do this.
3. Protect the backup admin accounts
Backup consoles should have their own strong credentials and multi-factor authentication, and as few people as possible should have access. Attackers target these accounts precisely because they control your safety net.
4. Test restores regularly
A backup you’ve never restored from is a hope, not a plan. Schedule test restores of files, mailboxes and key systems, and record how long they take.
5. Write down who does what
Agree in advance who decides to switch systems off, who contacts your IT provider, insurer and customers, and how you’ll report the incident. Police advise reporting ransomware attacks immediately. The Government has also set out proposals to increase incident reporting and reduce ransom payments, so it’s worth having a clear process ready.
Backups are one layer, not the whole answer
Good backups get you back on your feet, but they don’t stop data being stolen or systems being disrupted in the first place. Keeping devices patched, using multi-factor authentication everywhere and training staff to spot phishing all reduce the chance of an attack succeeding. Our free SME Cyber Security Checklist is a quick way to see where your gaps are.
How LevelUp Networks can help
We help UK SMEs design backup and recovery that’s built to withstand ransomware, alongside the wider protections that stop attacks getting in. Backup isn’t included in our Managed IT service as standard, but it’s an extra we can add and manage for you, including regular test restores. Our Cyber Security team can also review your current setup and recovery plan.
If you’d like a second opinion on whether your backups would survive an attack, email us at [email protected] or get in touch online. Existing clients can simply email our service desk.