Chapter 4 — Backups, incidents and the plan ahead

Chapter 4 — Backups, incidents and the plan ahead

Lesson map

Lesson 04 published. Map, example, EX057.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Backups"]
  N2["4.2 Testing a restore"]
  N3["4.3 An incident card"]
  N4["4.4 A practice drill"]
  N5["4.5 The plan ahead"]
  N6["Concepts — a copy, a test, a card, a drill"]
  N7["Data — restore evidence and the Monday fallback"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX057"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Backups"]
  N2["4.2 Testing a restore"]
  N3["4.3 An incident card"]
  N4["4.4 A practice drill"]
  N5["4.5 The plan ahead"]
  N6["Concepts — a copy, a test, a card, a drill"]
  N7["Data — restore evidence and the Monday fallback"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX057"]

[Learning outcomes]
    |
    v
[4.1 Backups]
    |
    v
[4.2 Testing a restore]
    |
    v
[4.3 An incident card]
    |
    v
[4.4 A practice drill]
    |
    v
[4.5 The plan ahead]
    |
    v
[Concepts — a copy, a test, a card, a drill]
    |
    v
[Data — restore evidence and the Monday fallback]
    |
    v
[Worked example] --> [Exercise EX057]

Learning outcomes

You will (1) confirm the clinic can restore its data; (2) write a one-page incident card; (3) set a simple plan for the months after the course.

4.1 Backups

Sofia asks the practice system provider how its data is backed up and how quickly it could be restored. The provider keeps daily backups for thirty days and can restore within a day. The clinic's email and shared files have no separate backup, so a deletion noticed late would be lost. Dr. Moss approves a low-cost backup service for email and files. Mr. Nowak explains that a provider keeping its service running does not mean your own deleted or encrypted files can be recovered, which surprises several people in the group.

4.2 Testing a restore

Sofia asks the technician to restore one folder and one mailbox from the new backup into a test area. The folder restores in minutes. The mailbox restore fails on the first attempt because the backup had not finished its first full copy. On the second attempt a week later it works. Sofia records both results in the change log. Mr. Nowak praises her for testing, because many businesses discover backup problems only when they need the backup, at the worst possible moment, and with clients waiting at the desk.

4.3 An incident card

Sofia writes a one-page incident card and pins it in the office. It lists what counts as an incident, such as a lost tablet, a suspicious sign-in alert, a ransom message or client details sent to the wrong person; who to call first, which is Sofia, then Dr. Moss, then the technician; the first steps, such as disconnecting an affected computer from the network; and the phone numbers of the practice system provider and the data protection adviser. She also keeps a paper appointment sheet for the day in case the system is unavailable.

4.4 A practice drill

Sofia runs a twenty-minute drill with Dr. Moss and two receptionists. The scenario: on a Monday morning, the practice system is unavailable for four hours. The team uses the paper sheet, phones clients with urgent appointments from a printed list and records treatments on paper for entry later. They discover the printed list is three weeks old and missing new clients. Sofia sets a weekly reminder to print a fresh list and lock it in the office. Mr. Nowak notes that drills find small gaps that are easy to fix beforehand and painful to discover during a real outage.

4.5 The plan ahead

At the last session, Sofia lists what changed in the month: personal accounts and second factors for everyone, updates back on, twelve sensitive files no longer open to anyone, a phone-back rule that stopped one fraud attempt, a tested backup and an incident card. She sets a short monthly routine: rerun the sharing check, review leavers' accounts, give one ten-minute session and test one restore. Mr. Nowak recommends the data governance rapid course next, since the clinic's retention of old client records is the next question Dr. Moss wants answered.

Worked example

Sofia adds a backup for email and files, tests a restore that fails once then succeeds, pins a one-page incident card, finds a stale client list in a drill and sets a four-item monthly routine.

Synthetic case. Providers, times and drills are synthetic.

Errors and limits

Assuming a cloud provider will recover your deleted or encrypted files can leave the business with no copy.

Concepts — a copy, a test, a card, a drill

A backup that has never been restored is a claim. Hollybank separates four artefacts. Each one answers a different question, and none of them replaces the others.

The provider keeping its own service running is not a copy of a file the clinic deleted or that an attacker encrypted. That distinction is why the email backup exists.

Data — restore evidence and the Monday fallback

Both restore results stay in the log. Recording only the success would hide the week in which the mailbox copy did not exist.

Decision flow — the practice system is down, or a screen asks for money

flowchart TD
  A["Monday morning problem"] --> B{"Is a computer showing a ransom note or acting on its own?"}
  B -->|Yes| C["Disconnect that computer from the network"]
  C --> D["Call Sofia, then Dr. Moss, then the technician"]
  B -->|No| E{"Is the practice system unavailable?"}
  E -->|Yes| F["Use today's paper appointment sheet"]
  F --> G["Phone urgent clients from a list printed this week and locked away"]
  G --> H["Write treatments on paper for entry after the system returns"]
  E -->|No| I{"Is the message demanding a new bank account?"}
  I -->|Yes| J["Use the phone-back rule. The incident card does not authorise the payment"]
  I -->|No| D

The card and the payment rule stay in force together. A frightening screen is not a reason to pay the account number printed on that screen.

Worked example — a full copy that is not a finished backup

The new backup service shows a green dashboard glyph on Thursday. Sofia does not record the backup as tested. The glyph appeared before the first full copy of the mailbox finished, which is the same condition that made the first restore fail. She asks the technician to restore one mailbox into the test area and waits for that result. The restore fails. She writes the failure, leaves the glyph out of the monthly routine, and schedules the second attempt for the following week. Only the second, successful restore of that named mailbox goes into the change log as a passed test.

Synthetic case. The green dashboard glyph, the mailbox nickname and the seven-day wait are invented. The failure condition matches the restore already recorded in section 4.2.

Apply

• EX057 — Whose copy is it? The practice-system provider keeps 30 days of daily backups. A receptionist deletes a shared-folder file that was never in the practice system. Which copy brings it back, and which promise does not? Rubric: 3 = only the separate email-and-files backup, after a restore of that folder has succeeded; the provider's 30 days never held this file;; 2 = the separate backup without the test;; 1 = the provider;; 0 = none.
• EX058 — Ransom screen at reception. State the first technical step, the call order, and whether the account number on the screen may be paid. Rubric: 3 = disconnect that computer; call Sofia, then Dr. Moss, then the technician; pay nothing from the screen, the phone-back rule still applies;; 2 = disconnect and the call order;; 1 = one of those;; 0 = none.

Exercises

• EX039 — Provider backups. How long does the practice system provider keep backups? Rubric: 3 = thirty days;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX040 — Missing backup. What had no separate backup? Rubric: 3 = email and shared files;; 2 = both;; 1 = one;; 0 = none.
• EX041 — First failure. Why did the first mailbox restore fail? Rubric: 3 = first full copy not finished;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX042 — First call. Who is called first in an incident? Rubric: 3 = Sofia;; 2 = partly correct;; 1 = other;; 0 = none.
• EX043 — First step. What is a first step for an affected computer? Rubric: 3 = disconnect it from the network;; 2 = partly correct;; 1 = other;; 0 = none.
• EX044 — Paper fallback. What paper fallback does Sofia keep? Rubric: 3 = the day's appointment sheet;; 2 = partly correct;; 1 = other;; 0 = none.
• EX045 — Drill length. How long was the drill? Rubric: 3 = twenty minutes;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX046 — Drill gap. What gap did the drill find? Rubric: 3 = printed client list was three weeks old;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX047 — Gap fix. How was the drill gap fixed? Rubric: 3 = weekly fresh printout, locked away;; 2 = partly correct;; 1 = partial;; 0 = none.
• EX048 — Sensitive files. How many sensitive files were closed off? Rubric: 3 = twelve;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX049 — Monthly routine. Name two items in the monthly routine. Rubric: 3 = sharing check, leavers, session, restore test;; 2 = two;; 1 = one;; 0 = none.
• EX050 — Next step. What course comes next and why? Rubric: 3 = data governance rapid, retention of old records;; 2 = both;; 1 = one;; 0 = none.

Continue studying — lesson 04 (chapter 04 of 20)

← Chapter 03 · Course chapter index · Chapter 05 →

Continue to the next authored lesson.