Розділ 7: Створення резервних копій та відновлення даних
In this section, you’ll learn to:
Creating Backups and Practicing Recovery
A file can be deleted by mistake, a laptop can fail, or an account can become unavailable. Ransomware can also prevent you from accessing information by encrypting it and demanding payment.
A backup is a separate, recoverable copy of information. It helps your nonprofit restore important records and continue working after something goes wrong.
The aim is to know what can be recovered, how recent it will be and who can restore it. You do not need to understand every technical detail, but you do need clear answers to those questions.
Start with what matters most
Use your protection inventory to identify information and services your organization could not easily replace. Consider:
Different services may need different recovery arrangements. A backup of office files does not necessarily include your website, email or fundraising platform. Ask two practical questions:
- How much recent work could we afford to lose? If records change every day, a monthly backup may leave too much work to recreate.
- How long could we manage without access? Information needed for tomorrow’s client appointments may require faster recovery than an archive of past newsletters.
These answers help determine how often backups are needed and what should be restored first.
Understand what you already have
Cloud storage, syncing and backups can work together, but they do different jobs.
Хмарне сховище
Keeps information on a provider’s systems.
What to check: What happens if files are deleted, the account is compromised or the service becomes unavailable?
Syncing
Keeps files consistent across devices or locations.
What to check: Deletions or unwanted changes may sync too.
Version history or deleted-file recovery
May let you recover an earlier version or a deleted item.
What to check: How far back can you go, what is covered and who can restore it?
Backup
Preserves recoverable copies for use after loss or damage.
What to check: Are the copies protected from the same event affecting the working information?
For example, deleting a shared folder on a laptop may also delete it from synced cloud storage. Recovery might still be possible through the service’s recovery features, but only within their limits.
“It is in the cloud” is not a complete recovery plan. Confirm what your service provides rather than assuming everything can be restored.
Know the options
Your nonprofit may use a backup service, an external drive, a provider-managed arrangement or a combination.
- External drive – Needs secure storage and an agreed backup routine. A drive left connected may be affected by the same attack as the computer.
- Cloud backup service -May automate backups and keep copies away from your premises. Confirm coverage, recovery limits, access protection and costs.
- Provider-managed backups – Can reduce the work your team performs, but responsibilities, coverage and restoration support must be clear.
- Recovery features included in existing services – May provide useful protection. Confirm whether they meet your needs or need to be supplemented.
Start by checking existing features and agreements. There may be gaps that require additional storage, a different arrangement or some spending. Identify those gaps so leadership can make informed decisions.
Protect the backups too
Backups may contain the same sensitive information as your working records. Limit access, protect backup accounts with MFA where supported and use encryption for sensitive backup information.
Avoid keeping every copy vulnerable to one event. A drive beside a laptop could be lost in the same theft or fire. A backup controlled through the same compromised account might also be deleted.
Options include keeping a copy offsite, disconnecting a backup drive when not in use, or using a service that protects retained copies from alteration or deletion.
The Canadian Centre for Cyber Security recommends multiple copies, offsite storage and an offline backup. You may hear the 3-2-1 rule: three copies in total, on two different types of storage, with one offsite. The practical goal is to avoid losing all copies together.
Confirm who does what
Assign responsibility for:
- Confirming which information and services are covered.
- Checking that scheduled backups complete.
- Following up on failures or missing information.
- Maintaining protected recovery access.
- Testing restoration and recording the results.
Include a backup person. If a provider performs the work, identify someone within your nonprofit who will review the arrangement and raise questions.
Ask the provider: “If we lost access to this information today, what could you restore, from what date, how long would it take and what would we need to do?”
A clear answer is more useful than a general assurance that backups are running
Practice restoring information
A successful backup notification shows that a process completed. It does not establish that the information can be restored and used. Begin with a small, planned test:
1/
Select a representative file that is included in the backup.
2/
Restore a copy to a safe test location without deleting or overwriting the working file.
3/
Confirm that it opens and contains the expected information.
4/
Record how long it took, who performed the test and any problems.
Keep restored sensitive information protected and remove temporary test copies when no longer needed.
A file test is a useful starting point. It does not prove that a whole website, database or service can be recovered. Arrange appropriate testing with your provider for those systems.
The Canadian Centre for Cyber Security recommends regularly checking that restoration works as expected.
Understand what backups cannot fix
Backups help recover information. They do not undo disclosure if someone has already copied or published it.
Recovery also needs to address the cause of the problem. After an account compromise or ransomware incident, restoring information before securing the affected environment could expose it again.
Use your incident-response process to coordinate recovery. Keep essential recovery instructions and contact details accessible through a protected alternative if your usual account or device is unavailable.
Set retention and review arrangements
Decide how long backup copies should be kept, considering recovery needs and the retention requirements discussed in Section 6.
Older copies can help recover from a problem discovered late, but keeping everything indefinitely creates additional information to protect. Confirm how your provider handles retained copies and eventual deletion.
Review backup coverage when you add a service, move files, replace devices or change providers.
A suggested policy rule
Essential organizational information must be covered by documented backup and recovery arrangements. Backup frequency and retention must reflect operational needs and applicable requirements. Copies must be protected from unauthorized access and from events affecting the working information. Assigned people must check backup completion, test recovery and follow up on failures.
Before adopting this rule, identify what is covered, the schedule, responsible people and how restoration will be tested.
Check your recovery arrangements
Choose one recovery test, assign a responsible person and set a date. If an answer is unknown, record who will confirm it.
Your takeaway
By the end of this section, you should have:
- Identified what needs to be recoverable and how quickly.
- Checked the coverage and limits of existing arrangements.
- Assigned responsibility for backups and recovery.
- Planned a restore test and follow-up on any gaps.
Next, you will look at the questions to ask vendors and service providers so your nonprofit understands what they protect, what they support and what remains your responsibility.
Розділ 8: Ставте постачальникам правильні запитання
Protecting your nonprofit when using third-party services means understanding each provider’s security responsibilities, managing access and information, and knowing how to get support when needed.
English 
French 
Chinese 
Spanish 
Ukrainian 