00WHAT THE GUIDANCE SAYS

One copy is
not a backup.

A tidy home desk with an open laptop, a phone and a small external hard drive resting beside them in soft morning light — AI-generated image, not a photograph of a real person or place.

Keep your important files in a second, separate place.

Devices get lost, stolen or broken, and ransomware can lock or erase what is on them. The UK's National Cyber Security Centre comes back to one habit: a copy kept apart, checked now and then.

COPY ITand keep it apartUpdated 14 October 2026

Check your risk

01Principles

Copy what matters
Unplug the drive
Check it is there
Small habits, safer files

02THE SHORT ANSWER

Two places,
not one.

A backup only helps if it survives what happens to the original.
Guidance focuses on a few simple habits.

TWO COPIES

Cloud and a drive

For things you cannot replace, such as family photos and videos, the NCSC suggests one copy in the cloud and another on removable media.

Check your risk

RANSOMWARE

Unplug when done

Malware, including ransomware, can spread to attached drives. The NCSC says to disconnect removable media when it is not in use.

See the numbers

STORAGE

Keep the copy apart

Northern Ireland's cyber security centre says backups should not be permanently connected to the device holding the original.

How to do it

03A QUICK RISK CHECK

What could go
wrong today?

Pick something that could happen to your files to see what kind of copy would get them back. The bar shows how far from the original device that copy needs to be.

Based on NCSC advice on backing up your most important data. This is general information, not a security audit.

Risk check

Choose a problemDeleted a file by mistakePhone lost or stolenLaptop stops workingRansomware locks filesCloud account taken over

Deleted a file by mistakeRecycle bin

Turn on the recycle bin and file history or snapshot features. The NCSC says these are quicker than a full restore when you only need a few files.

Phone lost or stolenAny separate copy

A copy anywhere other than the phone will do. Automatic cloud backups mean you are more likely to have a recent copy without having to remember.

Laptop stops workingAny separate copy

A cloud backup or an external drive both work. Removable media such as external hard drives suits large amounts of data.

Ransomware locks filesA disconnected copy

Ransomware can move to attached drives and infect the backup too. A drive that was unplugged when the attack happened is the copy that survives.

Cloud account taken overA second place

Anyone who gets into your cloud account can reach your backups. Use a strong password and two-step verification, and keep irreplaceable files on removable media too.

Source: NCSC, Top tips for staying secure online: always back up your most important data.

04TWO NUMBERS WORTH KNOWING

Attacks are common,
backups less so.

Figures from the UK government's Cyber Security Breaches Survey 2025,
based on 2,180 UK businesses surveyed from August to December 2024.

43%

UK businesses reporting a breach or attack in the last 12 months

Just over four in ten businesses reported a cyber security breach or attack, down from 50% in 2024. Phishing was the most common type, seen by 85% of those affected.

BREACHES · CSBS 2025

71%

Businesses backing up securely via a cloud service

Backing up by other means was less common at 47%, down from 55% in 2024. Among large businesses, 96% had data backups of some kind.

BACKUPS · CSBS 2025

The same survey found ransomware rose among businesses from under 0.5% in 2024 to 1% in 2025, about 19,000 businesses. US agencies' joint #StopRansomware Guide warns that many ransomware variants try to find and delete or encrypt accessible backups.

05FOUR HABITS TO TRY

Safer files,
without the fuss.

None of these needs special skills. Most phones and computers already include the backup and recovery features the guidance describes.

Decide what you cannot lose
Photos, documents, emails, contacts and calendars are the usual list. Start with anything you could not replace.
Switch on automatic backup
Cloud backups can run daily, weekly or when new files are added, so you do not have to remember.
Unplug the drive afterwards
If you use an external drive or USB stick, disconnect it when the copy is done, and set a calendar reminder for the next one.
Look inside the backup
Check that it really holds your important files, such as recent photos or documents you made this week.

A small external hard drive and a USB stick stored in an open wooden desk drawer, away from the computer — AI-generated image, not a photograph of a real person or place.

06WHY TEST IT

A backup you never
check is a hope.

A hand unplugging a USB cable from a small external hard drive on a wooden desk next to a laptop — AI-generated image, not a photograph of a real person or place.

Backups fail quietly: a folder left out, an account that stopped syncing, a drive that has not been plugged in for months. The NCSC advises checking that your backups contain all your important data once you have made them.

The US #StopRansomware Guide, from CISA and partner agencies, recommends offline, encrypted backups of critical data and regularly testing that they are available and intact. It is written for organisations, but the habit works at home too.

07Questions

Questions people ask

What counts as a backup?

The NCSC describes a backup as a copy of your important data that is stored in a separate safe location. A file that only exists on one phone or laptop is not backed up.

Is cloud storage enough on its own?

It is convenient and can run automatically, but anyone who gets into the account can reach the backups. For irreplaceable files such as family photos, the NCSC suggests keeping a copy on removable media as well.

Why unplug an external drive?

Viruses and other malware, including ransomware, can move to attached media automatically. If the backup is infected too, there is nothing left to recover from, so the NCSC says to disconnect it when it is not in use.

When might cloud backup not suit me?

The NCSC says it may not suit you if your internet connection is slow or unreliable, if you pay for data by the amount you use, or if your backups are very large.

How often should I back up?

The NCSC does not set a fixed schedule. It suggests automatic cloud backups, which can run daily or weekly, and a calendar reminder at regular intervals if you copy to removable media.

08Sources

One copy is
not a backup.