If ransomware hit your school over the Christmas holidays, how long until pupils, staff and safeguarding records are back? For most schools the honest answer is “we don’t know”. Backup and recovery for schools is usually judged on whether a backup exists, not on how long a restore actually takes.

The risk is real. The Cyber Security Breaches Survey 2025/2026, published by DSIT and the Home Office, found that 73% of secondary schools identified a cyber breach or attack in the past year. Most of those were phishing, and phishing is one of the most common ways ransomware gets in.

A school with untested backups can take weeks to recover. A school with immutable backups, a defined recovery time for each system and a restore it has rehearsed can realistically be teaching again by Monday.

This article explains the gap between backup and restore, what Microsoft 365 and cloud systems do and do not protect, what a trust-wide standard looks like, and how to run a proper restore test before the Christmas holidays.

Who This Is For

This guide is written for the people who carry the recovery question in education. School Business Managers who would face parents, staff and the trust board on day one of an outage. IT Managers and Network Managers in schools, sixth forms and FE colleges who inherited the backup setup rather than designed it.

It is also for MAT IT Leads, CFOs and COOs responsible for a trust-wide standard across schools that joined with very different systems. If you are expected to deliver enterprise-level IT on a charity budget, and you have never timed a full restore, this is for you.

If you are not technical, you do not need to run the test yourself. You need to ask your IT team or provider one question this week: “How long would it take to get our MIS and safeguarding records back, and when did we last prove it?”

The Backup You Have Is Not the Restore You Need

Almost every school says yes when asked if it has backups. Far fewer can answer the question that matters: how long until the MIS (your management information system, holding pupil, attendance and assessment data), safeguarding records and staff files are usable again?

We hear the same lines across the sector. “We assumed Microsoft backed it all up.” “Each school in the trust does its own thing.” “We’ve never actually tried a full restore.”

The painful discovery usually happens mid-incident. The backup turns out to be incomplete, encrypted alongside the live data, or so slow to restore that teaching stops for a fortnight.

Backup and Recovery for Schools: Start with the Restore, Not the Backup

Proper backup and recovery for schools starts by working backwards from Monday morning. Decide how quickly each system must return, then build the backup to meet that number, not the other way round. The result is a known restore time, not a hopeful guess.

The Department for Education’s cyber security standards ask every school and college to develop and implement a data backup plan and review it every year, with all settings expected to be working towards the standards by 2030. The DfE’s Cyber Security Hub sets out what that plan should include: the 3-2-1 approach of three copies of your data, on at least two separate devices, with one off site. It also recommends an offline or air-gapped copy, separate login credentials for backups, immutable storage for cloud backups, and regular restore testing.

DMS brings all of that together in one standard schools and trusts can check themselves against: the 3-2-1-1-0 rule. Three copies, two media types, one off site, one immutable, and zero errors verified through testing.

What immutable actually means

A truly immutable backup cannot be altered, encrypted or deleted by anyone during its retention period. That includes an attacker holding admin credentials. Not every product sold as “immutable” meets that bar, and some can still be overridden by an administrator account.

In practice we deliver true immutability with Object First Ootbi, purpose-built immutable storage for Veeam (the backup software many schools and colleges already use). Ransomware recovery for schools then stops depending on whether the attacker found the backups.

Newnham College, part of the University of Cambridge, shows what this looks like in education. Before moving to Object First, its recovery testing was finding inconsistencies in more than 15% of backup sets, and restores frequently stretched to several hours. With immutable storage in place, its IT Manager said the change had “greatly bolstered our confidence in the reliability and security of our backup solution”. A college is not a school, but the problem is the same. You can read how DMS supported that project in our Newnham College case study.

What this means for a trust

For MATs, the same standard applies to every school from the day it joins. Inherited and inconsistent setups are replaced with one tested recovery position the board can actually report on. The weakest school no longer sets the trust’s risk.

Book a free backup review with DMS and find out where your recovery position really stands before an incident tests it for you.

Microsoft 365 Backup for Schools: The Shared Responsibility Gap

Microsoft keeps its service running, but your data remains your responsibility. The DfE’s own Cyber Security Hub calls this the shared responsibility model: cloud providers make sure their platform is available, but that does not fully protect you from data loss through accidental deletion or cyber attacks. It catches schools out constantly.

Microsoft 365 retention features are not a backup. Recycle bins empty on a timer, retention policies can be misconfigured or deliberately changed by a compromised account, and a permanently deleted mailbox or Teams site may be unrecoverable once the retention window closes.

Microsoft 365 backup for schools means an independent, separately stored copy that you control, with restores you can test.

Cloud MIS and safeguarding platforms

Cloud MIS and safeguarding systems work differently. The vendor normally backs up the platform under its contract, so you cannot restore it yourself the way you would a server. But your school is still the data controller for those records.

That means knowing what the vendor’s recovery commitments actually are, how quickly they would get your data back, and whether you hold an up-to-date export of your own records you could work from in the meantime.

Step by Step: Running a Restore Test in the Next School Holiday

1. Choose what matters most. Pick three or four critical systems: the MIS, your safeguarding system, Microsoft 365 mail and files, and shared drives. Do not try to test everything at once.
2. Set a target time for each.Agree with leadership how quickly each system must be back. Safeguarding records might need hours, archived coursework might tolerate days.
3. Restore to an isolated environment.Never test into production. Recover on-premises systems to a sandboxed server and Microsoft 365 data to an alternate location, so live data is untouched. For a cloud MIS or safeguarding platform, ask the vendor to walk you through their restore process and timescales, and check you can open your latest export.
4. Time it and verify it. Start a stopwatch, run the restore, then open the data and confirm it is complete and usable. Verification is the zero in 3-2-1-1-0.
5. Record the gaps. Note anything missing, slow or broken, and agree fixes with dates before the next school holiday.
6. Report in plain English. Give the SLT or trust board one page: what was tested, how long it took, what changes next.

What to Watch Out For

• Treating Microsoft 365 retention as a backup. It is not, and permanent deletions prove it at the worst moment.
• Backups reachable with the same admin credentials as the live network. If the attacker can log in, they can encrypt or delete the backups too.
• Assuming cloud vendors cover everything. Know your MIS and safeguarding vendors’ recovery commitments, not just that they “back it up”.
• Trust growth without standardisation. Every joining school brings its own backup history, and the weakest one sets your risk.
• Testing file restores only.A folder coming back proves little if a full server or system restore has never been attempted.

Quick Checklist

• Write down your target restore time for the MIS, safeguarding records and Microsoft 365, and get leadership to agree it.
• Confirm you have an independent backup of Microsoft 365, not just native retention settings.
• Check at least one backup copy is truly immutable and cannot be deleted with stolen admin credentials.
• Ask your cloud MIS and safeguarding vendors for their recovery commitments in writing.
• Map your current setup against the DfE’s backup guidance and the 3-2-1-1-0 rule, and note every gap.
• For MATs, list what each school’s backup actually covers and when it was last tested.
• Book one timed restore test into the next school holiday.
• Put backup test results on the governor or trust board risk agenda.

FAQ:

Q: Does Microsoft 365 automatically back up our school’s data?

A: No. Microsoft keeps the service available, but under the shared responsibility model your data is your responsibility. Retention features and recycle bins have time limits and can be changed by a compromised account, so schools need an independent backup copy they control and can restore from.

Q: What is the 3-2-1-1-0 backup rule for schools?

A: It means keeping three copies of your data, on two different media types, with one copy off site, one copy immutable, and zero errors confirmed by regular restore testing. It builds on the DfE’s 3-2-1 guidance and brings in its recommendations on immutable storage and restore testing. It is a widely recognised good-practice framework rather than a legal requirement, and the final zero is the part most schools skip.

Q: What does an immutable backup mean in plain English?

A: A truly immutable backup is a copy that cannot be changed, encrypted or deleted by anyone until its retention period ends, even someone holding administrator passwords. It gives a school a clean copy to recover from after ransomware. Schools in the Risk Protection Arrangement (RPA) are already expected to meet the DfE’s backup standard, and a growing number of cyber insurers are asking about immutability, though it is a direction of travel rather than a universal mandate.

Q: How long should it take a school to recover after a ransomware attack?

A: There is no single right answer, which is exactly why each school should set its own targets per system. With immutable storage and a rehearsed restore, critical systems such as safeguarding records and the MIS can often return within hours to a day. Without testing, recovery routinely stretches into weeks.

Q: What should a MAT backup strategy include when schools join with different systems?

A: It should set one trust-wide standard covering what gets backed up, where copies are stored, which copy is immutable, how often restores are tested, and what each school’s cloud vendors commit to. Every joining school should be audited against that standard during onboarding, so the trust’s recovery position is known rather than inherited.

The Christmas holidays are your next real chance to test a restore properly, when IT staff can give it time without a full timetable running alongside. Miss it, and you go into the spring term still assuming rather than knowing.

You do not need to rebuild everything at once. You need one timed, verified restore of the systems your school cannot teach without, and an honest list of what that test reveals.

Don’t wait for an incident to discover your real recovery time. Book your free backup review with DMS. We start with a health check of what you have today and, for trusts, build towards one tested standard across every school on Object First immutable storage.