Why this guide exists
Most organisations have backups. Far fewer can prove they can recover.
There is a consistent gap between what IT teams believe they have and what they can actually restore under pressure. Runbooks stored on systems that are offline. Recovery time objectives set without ever running a timed test. DR plans written for a hardware failure, not a ransomware incident where systems need to be rebuilt clean, in the right order, with threat actors potentially still present.
Regulators and cyber insurers are now closing in on exactly that gap. DORA, NIS2, and the UK Cyber Security and Resilience Bill all require organisations to demonstrate recovery capability, not just backup coverage. This guide explains what that looks like in practice, using real benchmarks from ten UK industry sectors and Covenco’s direct experience of UK incidents since 1989.
This guide explains what that looks like in practice, using real benchmarks from ten UK industry sectors and Covenco’s direct experience of UK incidents since 1989.
What the guide actually covers
The Executive Guide to Backup and Recovery is a practical reference for IT and security leaders in UK mid-market organisations. It covers backup architecture, cyber recovery, regulatory compliance, sector-specific risk data, and crisis response. Every chapter is written to be used, not read once and filed.
Why backup strategies fail
The most common gaps between what IT teams believe they have and what they can actually recover from. The failure mode is usually invisible until it is too late.
Cyber recovery vs disaster recovery
Why they require different sequencing, different tooling, and a fundamentally different response posture. The mistakes that compound ransomware damage when the two are conflated.
The 3-2-1-1-0 rule in practice
What each digit means in an operational context, how to build a resilience architecture around it, and where most implementations fall short on the final zero.
RPO, RTO, and dependency mapping
How to set recovery objectives your business can meet under realistic conditions, and the recovery sequence should that accounts for the system dependencies most DR plans ignore.
Regulatory obligations
DORA, NIS2, NHS DSPT, and the UK Cyber Security and Resilience Bill translated from legal text into what IT and security teams are actually required to demonstrate.
Sector-specific threat and recovery data
Incident frequency, breach costs, recovery benchmarks, and regulatory mapping across ten UK industries, from healthcare and financial services to manufacturing and energy.
Multi-cloud and Microsoft 365 protection
What Microsoft and cloud providers protect natively, where the boundary of their responsibility ends, and what that means for your backup architecture.
Crisis management playbook
The first five moves in the first hour of a confirmed incident. Structured for operational use, not for reading after the fact.
Written for the people who carry responsibilityfor IT resilience.
This is not a vendor whitepaper. It was produced by Covenco’s technical team and draws on direct experience of UK incidents, audits,
and recovery projects. There is no product pitch inside it.
Sector coverage
Backup and recovery risk is not the same across every sector.
A healthcare trust operates under NHS DSPT and faces patient safety implications from downtime. A financial services firm is subject to DORA with mandatory incident reporting windows. A manufacturer risks production line shutdowns that a standard RTO calculation does not capture. The guide includes a dedicated chapter for each of the ten sectors below, covering the specific threat landscape, regulatory obligations, and recovery benchmarks relevant to that environment.
The Covenco 3-2-1-1-0 Framework
Three copies. Two media. One offsite. One immutable. Zero errors on restore.
The 3-2-1-1-0 rule defines the minimum architecture for a backup estate that can survive a ransomware attack. Three copies of every critical dataset. Two different storage media. One copy held offsite. One copy that is immutable and cannot be altered or deleted, even by a compromised administrator account. And zero errors on a verified, end-to-end restore test.
Most organisations reach the first four digits without too much difficulty. The fifth is where the gap opens. A backup job completing without errors is not the same as a recovery completing without errors. The difference only becomes visible when you attempt a full rebuild from scratch, domain controllers included, under realistic time pressure. Most IT teams have never done it. Most DR plans do not require it.
Free download
The Executive Guide to Backup & Recovery
✓ Why most backup strategies fail at the point of recovery
✓The difference between cyber recovery and disaster recovery
✓ How to implement the 3-2-1-1-0 rule in a real environment
✓ RPO, RTO, and dependency-aware recovery planning
✓ DORA, NIS2, NHS DSPT, and the UK Cyber Security and Resilience Bill
✓ Sector-specific threat data and recovery benchmarks across ten industries
✓ Multi-cloud and Microsoft 365 backup boundaries
✓A crisis management playbook for the first hour of a confirmed incident
Download the Executive Guide to Backup & Recovery
Fill in your details to download your free copy.
Related Resources
Further reading on Backup and Recovery
