Cloud Backup for Schools and MATs
Protect Microsoft 365, servers and important school systems with managed backup, restore testing and practical support for DfE and RPA requirements.
Cloud backup for schools that proves recovery works
Protect Microsoft 365 data, servers and important school systems with a clearer route back after deletion, ransomware, equipment failure or account compromise.
We help schools understand what is backed up, what is still exposed, how long recovery may take and what evidence can be shown to SLT, governors, auditors and the RPA.
Plain-English review. Clear next steps. No obligation and no hard sell.
You have backups, but nobody wants to answer the next question.
This page is likely to help if:
- You are not completely sure whether Microsoft 365 is independently backed up.
- Your backup reports arrive, but nobody regularly checks whether restores work.
- You need clearer evidence for SLT, governors, trustees, auditors or RPA cover.
- You have a mix of cloud services, local servers, devices and specialist school systems.
- Different schools in your trust have inherited different backup arrangements.
- You have already had a near miss involving deletion, ransomware or failed backups.
The question is not “do we have backup?”
The useful question is:
What can we restore, from where, and how quickly?
A backup review gives you a straight answer. It should identify the systems that matter, the gaps that still exist and the recovery evidence your school can produce.
You may already have a good setup. The review is designed to confirm that rather than assume something needs replacing.
Can your school answer these five questions today?
What is actually protected?
Include Exchange, OneDrive, SharePoint, Teams, file servers, virtual servers, endpoints, MIS data and other cloud services.
What is not backed up?
Some systems may rely on supplier retention, local copies or assumptions that have never been checked.
When was the last restore test?
A successful backup notification does not prove that the data or system can be restored properly.
How long would recovery take?
Restoring one email is different from rebuilding a server, SharePoint library or school-wide service.
Could the same incident reach the backups?
Backups need suitable separation and protection so one compromised account, system or network cannot remove every recovery option.
“We think so” is useful information
It tells you exactly where the review should begin.
The best time to discover a recovery gap is during a planned test, not during an incident.
What the school backup standard actually asks for
The current DfE cyber security standard expects schools and colleges to develop a backup plan and keep it connected to their disaster recovery and business continuity planning.
- At least three backup copies of important data.
- Copies held on at least two separate devices or systems.
- At least one copy held off-site.
- Backups made immutable so they cannot be changed after creation.
- Backups and recovery tested and logged termly, or after a significant service change.
- The backup plan reviewed at least annually or after major changes.
- Clear records of what can be restored, how long it may take and when the last test was completed.
Important: a backup product does not make an entire school “RPA compliant”.
Backup is one RPA condition. Schools must also meet the other applicable conditions, including NCSC training, Police CyberAlarm registration and having a cyber response plan.
Off-site and offline are not the same thing
Off-site describes where a backup copy is held. Offline describes whether that recovery copy can be reached or changed through the live systems, accounts or network.
A cloud backup can be off-site without necessarily being offline. The DfE standard requires at least one off-site copy and immutable backups, while the RPA conditions separately refer to offline backups.
Your school should be able to explain how at least one recovery copy is protected from the same compromised accounts, systems or incident affecting the live environment.
Governors should not have to take backup on trust.
A school should be able to show what is protected, where copies are held, when recovery was last tested and whether any backup failures remain unresolved.
The UK GDPR also requires appropriate measures that support timely restoration of access to personal data after a physical or technical incident.
Reviewed by Kevin Walker
Kevin is the founder of Black Swan Cyber Security Solutions and has more than 20 years’ experience helping schools with IT, cyber security, backup and recovery planning.
Last reviewed:
Cloud data, servers and school systems do not all use the same recovery method.
Microsoft 365 backup for schools
Best for: schools and MATs using Microsoft 365 for email, files, collaboration and shared administration.
Protects: agreed Microsoft 365 services such as Exchange, OneDrive, SharePoint and Teams.
Outcome: a more practical recovery route when emails, files, folders or cloud data are deleted, altered or compromised.
Server and endpoint backup
Best for: schools with on-premise servers, virtual machines, file shares or systems that cannot simply be recreated from Microsoft 365.
Protects: agreed physical and virtual systems, files and workloads.
Outcome: a clearer path to restore files, systems or complete workloads after hardware failure, ransomware or corruption.
MIS and other cloud platforms
Your MIS, safeguarding, finance, HR and curriculum systems may be hosted locally, managed by a supplier or delivered as a cloud service.
They cannot all be treated in the same way. We first establish what the supplier protects, what your contract promises and what the school remains responsible for.
Outcome: fewer assumptions and a written record of where responsibility for recovery actually sits.
Not every school needs every service. A cloud-only school may not need server backup. A school with local servers should not assume Microsoft 365 backup protects those systems too.
Microsoft 365 resilience and dedicated backup are not the same thing.
Microsoft provides a resilient cloud service and includes native retention and recovery features. Those features vary by application, licence, configuration and retention policy. A dedicated backup service adds a separately managed recovery layer with a clearer agreed scope.
| Recovery question | Microsoft 365 native tools | Managed Microsoft 365 backup |
|---|---|---|
| What is covered? | Depends on the application, licence, retention settings and configuration. | The protected services and users are agreed, configured and documented. |
| Point-in-time recovery | Available options and retention periods vary across Microsoft 365 services. | Designed to make granular recovery from protected backup copies more straightforward. |
| Independence | Recovery relies on Microsoft 365 configuration and the native service controls available. | Adds a separately managed backup layer outside the day-to-day Microsoft 365 environment. |
| Monitoring | Retention policies and administrative controls still need someone to configure and review them. | Backup jobs can be monitored and failures investigated as part of the managed service. |
| Evidence | Evidence may need to be assembled from different settings, policies and admin tools. | Backup status, scope and restore tests can be documented more clearly. |
The 3-2-1 backup rule, explained for schools
3
Three copies of important data
This normally means the live data plus at least two additional backup copies.
2
Two separate devices or systems
Not every copy should depend on the same server, storage platform, account or point of failure.
1
One copy held off-site
This provides another recovery route if the main site, system or network is affected.
The numbers matter, but they are only the start. The DfE also expects backups to be immutable and recovery to be tested and logged termly.
For schools using RPA cyber cover, check the separate requirement for offline backups too. Off-site tells you where the copy is held. Offline tells you whether the same live accounts, systems or incident can reach it.
A backup becomes valuable when somebody needs something back.
“The real test was not whether the backup job had run. It was whether the missing SharePoint data could be restored without turning the problem into a major incident.”
A deleted SharePoint library at a Derbyshire primary school
A member of staff accidentally deleted an important SharePoint library used for safeguarding administration. The immediate question was not whether a backup report showed green. It was whether the school could recover the right data without turning an avoidable mistake into a prolonged operational and data protection problem.
Because the school had a separate Microsoft 365 backup in place, the library could be located and restored from an independent recovery copy. The action was then documented for the school’s IT and data protection records.
That gave the school evidence of an actual recovery, rather than relying on a successful backup notification. Without the separate copy, it may have had to depend on whatever native recovery options remained available or reconstruct the library manually, bringing more uncertainty, disruption and staff time.
The school has not been named to protect confidentiality.
From “we think it is backed up” to a documented recovery plan
You do not need to choose a product before speaking to us. The first job is to understand what you already have.
Backup review
We look at Microsoft 365, servers, devices, cloud systems, current suppliers and existing backup arrangements.
Written gap summary
You receive a short explanation of what is protected, what is unclear and what needs attention.
Right-sized plan
We recommend only the backup services needed for your school or trust, rather than forcing everything into one package.
Setup and testing
Backups are configured, initial checks completed and recovery tested against the agreed scope.
Monitoring and evidence
Backup jobs are monitored, failures investigated and useful records retained for reviews and reporting.
What does cloud backup for a school cost?
Pricing depends on what needs protecting. These figures provide a sensible starting point before a review.
Microsoft 365 cloud backup
From £4 per user, per month
Education and volume discounts may be available. The final price depends on the protected users, services and required scope.
See Microsoft 365 backupServer and endpoint backup
Typically £30 to £150+ per month
The exact cost depends on the number of systems, storage, retention, recovery expectations and the type of workloads being protected.
See server backup optionsThese are indicative starting points, not a fixed quotation. We will confirm the scope and full cost before any work begins.
Is managed school backup the right fit?
This is likely to be a good fit if:
- Losing Microsoft 365 data or a school server would cause real disruption.
- You want recovery evidence rather than another untested assumption.
- Your current provider cannot clearly explain the backup and restore process.
- You need a consistent approach across several schools.
- You want failed backup jobs to be noticed and investigated.
- You need help mapping backup to DfE, RPA and business continuity expectations.
This may not be the right fit if:
- Your existing backup is already independently monitored, tested and well documented.
- Your school holds no important data in Microsoft 365, locally or on specialist systems.
- You only want the cheapest storage space and do not need managed recovery support.
- You expect backup alone to prevent ransomware or account compromise.
- You are unwilling to identify critical systems or take part in recovery planning.
Cloud backup for schools: questions we are regularly asked
Does Microsoft 365 already back up our school data?
Microsoft 365 includes resilience, retention, recycle bins and native recovery features. These are useful, but they are not always the same as having an independently managed backup layer with a defined scope and recovery process.
The right answer depends on which Microsoft 365 services you use, your licences, retention settings and how long ago the deletion or change occurred.
Will cloud backup make our school RPA compliant?
It can help you meet and evidence the RPA condition relating to the DfE backup standard. It does not satisfy all RPA cyber cover conditions by itself.
Schools must also check the current requirements covering NCSC training, Police CyberAlarm and their cyber response plan.
How often should a school test its backups?
The current DfE standard says the backup plan should be tested termly, or more often following a significant service change. Testing should include the ability to recover and restore from backup, and the result should be logged.
Do cloud-only schools still need backup?
Being cloud-only may remove the need for traditional server backup, but it does not remove the need to understand how important cloud data would be recovered.
Microsoft 365, MIS platforms and other cloud suppliers all have different responsibilities, retention arrangements and recovery options.
Is an off-site backup the same as an offline backup?
No. Off-site means the copy is stored away from the main school site or primary system. Offline means the recovery copy is not directly reachable through the live environment in a way that would allow the same compromised account, system or incident to alter or remove it.
A cloud backup may be off-site but not automatically offline. Schools should check how access is separated, how backup copies are protected and whether ransomware or compromised administrator credentials could affect every recovery option.
Does backup stop ransomware?
No. Backup provides a recovery option after data or systems have been affected. It does not replace endpoint protection, patching, identity security, monitoring or incident response.
Good resilience combines prevention, detection, response and recovery.
Can you work alongside our existing IT provider?
Yes. The review can be carried out with your internal IT team, local authority support, managed service provider or trust-wide technology team.
The aim is to establish the recovery position clearly, not to create unnecessary disruption or replace a provider that is doing a good job.
What should we bring to the initial backup review?
Useful information includes your list of critical systems, current backup reports, supplier contracts, Microsoft 365 setup, server list, previous restore tests and any known recovery concerns.
Do not worry if this information is incomplete. Finding those gaps is part of the review.
Backup is one part of keeping a school secure and recoverable.
These guides explain how backup connects with wider DfE standards, RPA cyber cover, staff training and practical school cyber security.
Know what can be restored before something goes missing.
We will review your Microsoft 365 data, servers, devices and key school systems, then give you a clear explanation of the gaps, priorities and realistic next steps.
No obligation. No predetermined package. Just a clearer answer about your school’s ability to recover.
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.
Stay ahead of cyber threats - Subscribe to the Black Swan newsletter
Protect your school or business with expert advice tailored to schools and small businesses. Get the latest cyber threat insights, practical data protection tips, and guidance on password security, ransomware prevention, and compliance – all delivered straight to your inbox.
Join the Black Swan community today and take charge of your cyber security.
Click here to preview an example newsletter and see what you’ll gain by subscribing!