Home / Commons / Backup planner

Tool

Backups you can actually restore.

List what you would need to reopen, where each copy goes and which copy ransomware cannot reach. Get a printable backup plan, a restore-test schedule and a log to keep.

FreeNo sign-upNothing leaves your browserPrints in two pages

This tool needs JavaScript, which is turned off. Below is the blank plan and log instead: print them with your browser’s Print command and fill them in by hand. The backup and restore log template is also available as a spreadsheet.

Free, no sign-up. Nothing you type leaves your browser. Your plan is saved in this browser only, so you can come back to it. Use Clear everything when you are done, especially on a shared computer.

01About this plan
02What you have, and where the copies go

One item for each thing you would need to reopen after a bad day: systems, files, finance records, email and the settings that make it all work. A copy ransomware can reach is not a safe copy: at least one should be offline (unplugged and stored away) or deletion-protected (a service that prevents deletion for a set period, sometimes called immutable).

03Restore-test log

Every time you restore something to prove a backup works, note it here. A backup you have never restored is a hope, not a plan.

Your plan

Fills in as you type.

Backup plan

Organization:

Plan owner
Updated
  • Two or more copies. Of everything you would need to reopen, in different places.
  • At least one copy out of reach. Offline, or deletion-protected.
  • Restore something regularly. Write down how it went.
WhatCopiesOut of reach?Restore test

Keep a printed copy away from the office network, next to your incident plan.

Made with the free backup planner at moraph.org/commons/backup-planner. General information, not advice about your systems.

Restore-test log

Organization:

How to use it
Add a row every time you restore something to check a backup.
DateWhat was restoredTime takenResultNotes

Tip: print in landscape for the widest tables. In the print dialog, “Save as PDF” keeps a copy.

What good looks like

A backup is only as good as the last restore.

  • Out of reach. Ransomware looks for backups first. Keep at least one copy offline (a drive that is unplugged and stored away) or in a service that prevents deletion for a set period, often called immutable storage.
  • Cloud is not automatically a backup. A cloud service keeps your data available, but a deletion, a sync of encrypted files or a compromised account can reach it too. Ask each supplier what they back up, for how long, and how you would get it back.
  • Restore, don’t just check the light is green. Pick something real, restore it somewhere safe, open it and time it. Write it down in the log.
  • Remember the settings. Router and firewall settings, account and sharing settings, and the list of who has administrator access take days to rebuild from memory.

The field guide explains why, and the incident plan builder records where the backups are on your one-page plan.

Sources

Where this comes from.

Primary sources only: standards bodies, governments, regulators and the services themselves. Each was opened and checked on 18 October 2026. If something here no longer matches the source, the source wins; please tell us at hello@moraph.org.

Last reviewed October 2026

  1. CISA#StopRansomware guide (backups: offline, encrypted, tested)www.cisa.gov/stopransomware/ransomware-guide
  2. UK National Cyber Security CentreSmall business guide: backing up your datawww.ncsc.gov.uk/collection/small-business-guide/backing-your-data
  3. UK National Cyber Security CentreOffline backups in an online worldwww.ncsc.gov.uk/blog-post/offline-backups-in-an-online-world

Not sure your backups would work?

Shield gives eligible organizations a security review, including a hard look at backups and a supervised restore test.

Apply for Shield