Backup that survives ransomware — a small business guide for Australia 2026

Why most small business backups fail when it matters

Backup is the control that decides whether a ransomware incident is survivable. In the Australian Cyber Security Centre's small business case notes, the difference between a business that returns to trading in days and one that closes permanently is almost always backup. And yet most small business backups do not work when needed — not because they were never set up, but because they were set up against the wrong threat model.

The 2018 threat model was hardware failure. The 2026 threat model is ransomware. The two have very different requirements. This guide explains the difference, shows the backup patterns that actually survive ransomware in 2026, and identifies the evidence Australian cyber insurers expect at renewal. It is written for owners and office managers, not IT specialists.

The threat model that matters in 2026

Ransomware operators in 2026 are sophisticated. They typically achieve initial access via phishing or a missing patch, dwell in the network for two to fourteen days, and during that time they actively look for and delete or encrypt every backup copy they can reach. The Australian Cyber Security Centre and IBM X-Force Threat Intelligence Index both highlight backup destruction as a standard pre-encryption step.

This is why the 2010s pattern of "keep a copy in the same cloud account as the live data" fails — the same compromised account that controls the live data also controls the backup. Modern ransomware notes occasionally taunt victims with "we deleted your backups; here is the proof".

The pattern that survives requires three properties:

1. Separation. The backup lives in a different account, region, or physical location from the live data.
2. Immutability or offline. The backup cannot be encrypted, modified, or deleted by an attacker who compromises the live data — either because it is stored in an immutable form (write-once-read-many) or because it is physically offline (disconnected media).
3. Tested restore. Within the last twelve months you have actually restored something from the backup. If it has not been tested, it is a hope, not a backup.

The 3-2-1-1 rule

The classic small business backup guideline is the 3-2-1 rule — three copies of your data, on two different media, with one copy stored offsite. In 2026 most Australian guidance, including the Australian Cyber Security Centre and business.gov.au, has extended this to 3-2-1-1 by adding one immutable copy.

A typical 3-2-1-1 layout for an Australian small business on Microsoft 365:

• Copy 1 — live data. Microsoft 365 (Exchange, SharePoint, OneDrive).
• Copy 2 — local cache. OneDrive or SharePoint local sync on staff laptops.
• Copy 3 — backup. Microsoft 365 Backup, a third-party SaaS backup, or a managed backup service.
• The "1" — immutable. That backup product is configured with immutability or write-once retention.
• The added "1" — offsite. The backup product runs in a different Microsoft region or with a different vendor entirely.

You do not need to manage four separate processes — most modern SaaS backup products satisfy several layers in one product if configured correctly.

Microsoft 365 retention is not backup

This is the most common misunderstanding in Australian small business. Microsoft 365 retains data for a limited period — typically thirty days for deleted Exchange items, ninety-three days for SharePoint sites, and similar timeframes for OneDrive. This retention is for accidental-deletion recovery, not for ransomware response.

If a ransomware operator deletes a SharePoint site and you do not notice within ninety-three days, the data is gone. The Microsoft 365 native retention will not save you. The ACSC small business guidance and the cyber insurance underwriting questions both treat retention and backup as distinct controls.

The fix is to use Microsoft 365 Backup (Microsoft's first-party backup product launched in 2024) or a reputable third-party SaaS backup such as Datto, Veeam Backup for Microsoft 365, AvePoint, Backupify, or Spanning. All offer immutability and longer retention.

Practical patterns for Australian small business

The pattern depends on your primary platform.

Microsoft 365 environments

Microsoft 365 Backup with immutability. Microsoft's own backup product is the simplest path for businesses already on Microsoft 365. Enable in the admin centre under Setup → Microsoft 365 Backup. Configure immutability and the retention period (typically one year for small business; longer if you have regulatory obligations). The cost is per user per month and is generally accepted as the lowest-friction option.

Third-party SaaS backup. Veeam, Datto, AvePoint, Backupify all provide Microsoft 365 backup with immutability. They additionally back up Teams chat, Planner, and certain other workloads that Microsoft 365 Backup does not yet cover. Most are billed per user per month at similar pricing to Microsoft's offering.

Whichever you choose, document the configuration in a one-paragraph backup policy: what is backed up, where to, retention, immutability setting, and who has admin access.

Google Workspace environments

Google Workspace has limited native retention — Vault provides retention for compliance but is not a recovery-focused backup. The same SaaS backup vendors (Veeam, AvePoint, Backupify, Spanning) provide Google Workspace backup with immutability. The configuration approach is identical to Microsoft 365.

File shares on a local server

If you still operate an on-premises Windows file share, the recommended pattern is a daily backup to a NAS configured with immutability (most modern NAS devices — Synology DSM 7.2+, QNAP QTS 5.1+ — support immutable snapshots), plus a weekly external drive that is rotated offsite. The offline external drive is the irreplaceable element — it cannot be encrypted by ransomware because it is physically disconnected most of the time.

Cloud workloads (AWS, Azure)

For small businesses with AWS or Azure resources, configure backup policies in AWS Backup or Azure Backup. Both support immutability — AWS Backup via "Vault Lock" and Azure Backup via "Immutable vaults". Microsoft Learn and AWS documentation (both current 2026 editions) document these settings.

Restore testing — the one thing most businesses skip

Backup that has never been restored is a hope, not a plan. ACSC Essential Eight Maturity Level 1 (Australian Cyber Security Centre — Essential Eight maturity model, accessed 16 June 2026) explicitly requires that a backup restore has been tested. Australian cyber insurers ask for the date of the last successful restore on every 2026 underwriting form.

The test does not need to be elaborate. A typical small business restore test looks like this:

1. Pick one mailbox and one file folder that you can use as test targets.
2. Sign in to your backup product as admin.
3. Restore the mailbox to a test target — for example, an alternate mailbox or PST file.
4. Restore the file folder to a test SharePoint library or OneDrive location.
5. Open a few items and confirm the content looks right.
6. Document the date, what you restored, and what you saw.

The entire test takes thirty to ninety minutes depending on data size. Repeat annually — diarise the next test before you close the previous one.

The documented note is the evidence your cyber insurer will ask for. The OAIC also treats restore testing as part of "reasonable steps" under Australian Privacy Principle 11 (OAIC — Australian Privacy Principles, accessed 16 June 2026).

What to do during an actual incident

If ransomware hits, the backup is only useful if you can use it without rebuilding the entire environment first. Some practical points:

• Do not pay the ransom. Australian government policy and most cyber insurance policies treat ransom payment as a last resort, not a first option. The Australian Cyber Security Hotline (1300 CYBER1) is the right first call.
• Isolate before restoring. If you restore to systems that are still compromised, the ransomware will encrypt the restored data too. Rebuild or reformat the target environment first.
• Restore in stages. Bring back the most business-critical data first — typically email and the active customer file folder. Defer archival data.
• Document everything. The OAIC Notifiable Data Breaches scheme (OAIC — Notifiable Data Breaches scheme, accessed 16 June 2026) thirty-day assessment clock is running. Every action and decision should be timestamped for the post-incident review and any regulator engagement.

A one-page incident response plan that includes the backup recovery sequence is part of the broader small business cyber baseline. The ACSC publishes a template at cyber.gov.au.

What insurers want to see

The cyber insurance underwriting questions specific to backup, as observed across 2026 Australian SMB insurance forms:

• "Are regular backups taken?" — Yes (state frequency).
• "Are any backup copies kept offline or immutable?" — Yes (state which: immutability or rotating offline drive).
• "When was the last successful restore test?" — Date in the last twelve months.
• "Who has admin access to the backup product?" — A short list with MFA enabled on each account.
• "Is the backup separated from the production environment?" — Yes (different account or different vendor).

Each "yes" should be supported by evidence — a screenshot of the backup product configuration, the test restore note, the admin list. The pattern is the same across every Australian insurer: evidence beats opinion.

Where to go from here

If you want to confirm where your backup setup sits against the ACSC baseline and cyber insurance expectations, the free EDUC4TE Small Business Cyber Security Assessment includes weighted questions for backup coverage, immutability, and restore testing. The results page includes the backup-related items from the insurance underwriting evidence list. If you would prefer a practitioner to configure Microsoft 365 Backup with immutability and run the first restore test with you, the practitioner-led assessment service covers exactly that scope.

Whichever path you choose, the message is the same one the Australian Cyber Security Centre has been repeating since 2020: ransomware is survivable when backup is separated, immutable, and tested. The work to get there is measured in hours, not days.

Sources

• Australian Cyber Security Centre, Small Business Cyber Security Guide, current edition late 2025. cyber.gov.au.
• Australian Cyber Security Centre, Essential Eight Maturity Model, November 2025 ISM revision. cyber.gov.au.
• Microsoft Learn, Microsoft 365 Backup overview, current 2026 guidance. learn.microsoft.com.
• Microsoft Learn, Azure Backup immutability for Recovery Services vault, current 2026 guidance. learn.microsoft.com.
• AWS Documentation, AWS Backup Vault Lock, accessed May 2026. docs.aws.amazon.com.
• Office of the Australian Information Commissioner, Australian Privacy Principles, APP 11. oaic.gov.au.
• Office of the Australian Information Commissioner, Notifiable Data Breaches scheme, current guidance 2026. oaic.gov.au.
• business.gov.au, Cyber security for business, current edition 2026. business.gov.au.
• IBM X-Force Threat Intelligence Index 2025.

Sources referenced in this article: ACSC Essential Eight Maturity Model, OAIC Australian Privacy Principles (APP 11), OAIC Notifiable Data Breaches scheme, IBM X-Force Threat Intelligence Index 2025, ACSC Small Business Cyber Security Guide, Microsoft Learn (Microsoft 365 Backup / Azure Backup), AWS Documentation (AWS Backup Vault Lock), business.gov.au, Australian Cyber Security Hotline 1300 CYBER1.