CSA Cyber Essentials Backup and Incident Response Requirements: A Plain-English Checklist
There is a line in CSA's Cyber Essentials document that reads differently after a morning without email. It says an organisation's incident response plan should be kept in paper form or on an offline system. In other words: do not store the instructions for a crisis in the place the crisis has just switched off.
The quick answer: the Cyber Essentials mark from the Cyber Security Agency of Singapore (CSA) groups its measures into five categories: Assets, Secure/Protect, Update, Backup and Respond. The Backup and Respond categories are the two that decide how well a business copes when a service goes down. This article sets out what they require, taken from CSA's own document.
What is the CSA Cyber Essentials mark?
Cyber Essentials is a cybersecurity certification from CSA, launched in 2022, that helps organisations such as SMEs prioritise the measures needed to protect their systems and operations from common cyber attacks. CSA also describes it as a badge of recognition for organisations with good cyber hygiene. A more advanced certification, Cyber Trust, sits above it.
| Category | Measures |
|---|---|
| Assets | People: train employees. Hardware and software: know what you have and protect it. Data: know what data you hold, where it is, and secure it |
| Secure/Protect | Virus and malware protection; access control; secure configuration |
| Update | Software updates |
| Backup | Back up essential data |
| Respond | Incident response |
Source: CSA, Cyber Essentials mark certification document (March 2025); CSA, Summary of initiatives to help organisations enhance cybersecurity.
What are the Cyber Essentials backup requirements?
| What CSA's document sets out | In plain English |
|---|---|
| Identify and back up business-critical data and systems, based on what business recovery and any contractual or regulatory obligations need | Decide what you could not run without, and back that up first |
| Back up regularly, at a frequency matched to business needs and tolerance for data loss | If losing a day's work would hurt, back up more often than daily |
| Protect backups from unauthorised access | Only the right people should be able to reach them |
| Store backups separately and isolated from the operating environment | A backup sitting on the same system is not a second copy |
| Good practice: test backups at least twice a year | Restore something for real, twice a year |
The document also recommends automating backups where feasible, protecting them with at least a passphrase, storing them offsite where feasible, and keeping frequent backups online for faster recovery.
For Microsoft 365, that points to an independent copy of mailboxes and files kept outside the service. See Synology NAS for Microsoft 365 backup and the 3-2-1 backup rule.
What are the Cyber Essentials incident response requirements?
| What CSA's document sets out | In plain English |
|---|---|
| Establish and keep up to date a basic incident response plan for common incidents such as ransomware, social engineering, data breaches and DDoS attacks | Write down what you would do, before you need it |
| Include clear roles and responsibilities for key personnel | Name who decides and who does what |
| Include procedures to detect, respond to and recover from common threats | The steps, in order |
| Include a communication plan and timeline for escalating and reporting to internal and external stakeholders | Who gets told, how, and how fast |
| Communicate the plan to all employees with access to IT assets | A plan nobody has read is a document, not a plan |
| Where cloud is in scope, include cloud-specific scenarios and verify the cloud provider's obligations for investigating and remediating incidents | Know what your cloud provider will and will not do for you |
| Keep the plan in paper form or on an offline system that cannot be compromised during an incident | Print it |
The document also recommends post-incident reviews and reviewing the plan at least annually.
Source: CSA, Cyber Essentials mark certification document (March 2025), Annex A.
How does a cloud outage test these two categories?
A provider outage is not a cyber attack, and Cyber Essentials is written with attacks in mind. But the same preparation applies, which makes an outage a free rehearsal. Ask yourself:
- Did anyone know where the response plan was, and could they open it?
- Was it clear who should confirm the outage and tell staff?
- Did you know what your cloud provider commits to during an incident? See how to claim a Microsoft 365 service credit.
- Could staff reach the files they needed from a copy outside the affected service?
- When did you last restore something from backup?
A provider outage is the cheapest drill you will ever run. The fire was someone else's.
Is there funding support?
CSA has aligned the pre-approved cybersecurity solution categories on the SMEs Go Digital programme with the Secure/Protect and Backup measures, adding "Backup" and "Integrated anti-malware, firewall and backup" categories. Grant arrangements changed in 2026. See is the PSG grant still available for cybersecurity and backup.
Getting help in Singapore
For backup hardware and continuity planning, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
What are the five categories of CSA Cyber Essentials? Assets, Secure/Protect, Update, Backup and Respond.
How often should backups be tested under Cyber Essentials? CSA's document sets out, as good practice, testing backups at least twice a year.
Where should backups be stored? Separately from, and isolated from, the operating environment. Offsite storage is recommended where feasible.
Should an incident response plan be printed? CSA's document says the plan should be kept in paper form or on an offline system that cannot be compromised during an incident.
This article is general information compiled from the CSA sources linked above as at 13 November 2026. It is not professional or certification advice and is not a statement by or on behalf of CSA. Refer to CSA's current documents for certification requirements.
SourceIT Approved
Researched and verified by the SourceIT team for Singapore buyers.
