The backup in your laptop bag can disappear with the laptop
Share
Published
A backup stored in the same bag as the laptop can disappear in the same loss. A useful backup plan should consider where the copy is kept, who can access it and whether the information can actually be restored.
A portable drive is convenient for moving a copy out of a computer. That convenience is not the same as independence from the event that damages or removes the computer.
Choose the loss you are preparing for
Ask what the backup needs to survive: a failed drive, a lost bag, accidental deletion or an account problem. A copy that solves one situation may be exposed to another.
For a small business, identify the information required to resume essential work. Assign the backup process to a person and name a deputy. Do not let the only person who understands the process become another single point of failure.
Separate storage from access to storage
A backup can be physically separate but still depend on the same unavailable account or credential. Review where the required recovery information is held and who is authorised to use it.
The account-recovery plan helps identify that dependency. Keep secrets out of the general offline recovery sheet, while recording where the owner can securely find the material needed.
Check the copy’s contents
Identify what the backup includes and excludes. A synchronised folder, an exported report and a full device backup can serve different purposes. Confirm the scope of the method actually in use.
Record the last successful completion and any error that needs attention. A scheduled task existing on the calendar is not evidence that its latest run produced a usable copy.
Run a harmless restoration test
Choose a non-sensitive sample and restore it to a separate approved location. Check that it opens, contains the expected version and can support the intended task. Avoid overwriting production files merely to demonstrate that a restore button works.
NIST’s small-business guidance recommends protecting and testing backups. The test should produce evidence the owner can understand, including the date, sample, result and any limitation.
| Question | Evidence to keep |
|---|---|
| What was copied? | Defined scope and exclusions |
| When did it complete? | Completion record or reviewed log |
| Where is the independent copy? | Approved location, described without exposing secrets |
| Can it be restored? | Result of the controlled sample test |
| Who handles failure? | Owner, deputy and escalation route |
Protect a portable drive as information
Limit access to the device and use the organisation’s approved protection for the information involved. Keep it in an appropriate location. If a drive is lost, assess what it held and the protection actually applied; do not assume its contents were unreadable merely because it was called a backup.
Avoid connecting an unknown drive to an ordinary work computer. Use the organisation’s approved handling process for found or suspicious media.
Plan for retirement too
When a drive is replaced, follow an appropriate sanitisation or disposal process for its media and sensitivity. NIST’s current media-sanitisation guide is a reference for that decision. Deleting a folder is not an assessment of the whole device’s disposal requirements.
Turn the backup into an exercise question
During the privacy incident tabletop, ask who can find and restore the required information if the normal laptop and its bag are unavailable. Record the first practical obstacle and assign a fix. A backup strategy becomes more credible when the deputy can demonstrate the recovery path.
Featured image: AI-generated conceptual illustration.
