A shared cloud folder can make files easy to reach without answering the harder question: what would your business do if an essential record disappeared? Ireland’s National Cyber Security Centre distinguishes cloud storage from cloud backup in its SME guidance. A backup preserves a recoverable copy from a point in time; simply knowing that a file is stored online does not describe its recovery arrangements. [1]

For a small Irish business, a useful check starts with the records needed to keep working, then follows one ordinary file through the recovery process. This is a maintenance guide based on existing NCSC advice, not a report of a new cyber incident.

Start with the information you need tomorrow

The NCSC recommends identifying essential data, equipment and third-party suppliers that manage systems on your behalf. [2]

Make a short working list: bookings, orders, supplier contacts, project files or other records your team uses each day. Beside each, record where it lives, who looks after it and which account is needed to recover it. Keep the list somewhere authorised colleagues can reach if the usual computer is unavailable.

Choose the order by operational need. A useful question is what would stop the next day’s work, rather than which folder contains the most files. This gives you a practical starting point for a conversation with your IT provider.

Ask what the backup actually protects

The NCSC advises keeping backups secure and separate from the business network because attackers may target them as well as the original data. It also highlights questions about storage location, access and sensitive customer information. [1]

Ask your provider whether older versions can be recovered, how long they are retained and whether someone who compromises the everyday account could also delete the recovery copies. Record the answer for each important service; do not assume that all cloud products have the same settings.

Test a copy without disturbing live work

Arrange a harmless recovery exercise with whoever administers the system. Create a non-sensitive test document, confirm it has entered the backup process, and ask for it to be restored into a separate test location. Keep live customer files and the working folders out of the exercise.

Write down the steps, the account required and any difficulty opening the recovered copy. A completed test gives you something concrete to discuss; a dashboard saying that a job ran does not tell you whether your team knows how to retrieve a file.

Put a review date beside the record, particularly when you change suppliers or move important work to a new service. The goal is a recovery process someone can follow, with ownership and access settled before it is urgently needed.

Official guidance was checked on 11 October 2026.