SCADA backup and recovery: protecting PC-based supervisory control systems

This guide is written for controls and automation engineers, OT infrastructure owners and plant leaders responsible for recovering PC-based SCADA systems, including SCADA servers and clients, HMI and engineering workstations, and historians. It does not cover native backup of PLC or RTU logic and firmware; those assets remain within the automation vendor's engineering and lifecycle-management tools.

A SCADA server, HMI or historian cannot be recovered like an ordinary IT workload. These are long-lived, PC-based systems built around validated configurations, often on operating systems that predate the current IT refresh cycle. Many sites have limited on-site IT support and little tolerance for a long recovery window.

When one of these systems fails or is compromised, the plant needs a fast route back to a known-good state. Authorized site personnel should be able to carry out that recovery without introducing additional operational risk.

This article explains what makes SCADA backup and recovery different from general IT backup, what a SCADA backup plan should contain and how to prepare recovery without compromising site safety or uptime. It also shows how Acronis Cyber Protect for OT addresses those requirements.

• Full-image backup supports whole-system and bare-metal recovery, while file-level restore can address limited deletion or corruption when the underlying system remains operational.
• Include the vendor-specific project and configuration files required by the protected application alongside the system image.
• Set backup frequency according to each system's recovery point objective, rate of change, operational constraints, supported vendor methods and site policy. Configuration images and historian data may require different schedules.
• Air-gapping reduces internet-borne exposure but not removable-media risk; ISA/IEC 62443-3-3 addresses this through its portable-device use-control requirement.
• Recovery planning should define and document scope, validation method, authorization, testing cadence and documentation in advance; the specific recovery sequence for a live process is always a matter for your facility's own incident-response, OEM and change-control procedures.

SCADA backup means creating and validating recoverable copies of the PC-based systems in a supervisory control environment — SCADA servers and clients, human-machine interface (HMI) and engineering workstations, historians and other OT application servers — according to the site's recovery requirements. The goal is to return a failed or compromised asset to a known-good state with minimal manual reconstruction.

Acronis Cyber Protect for OT supports secure backup and fast recovery for PC-based OT systems, including SCADA servers, HMI, engineering workstations and historians. The platform is used by leading automation vendors and supports XP-era through current operating systems, authorized local recovery, recovery to different hardware and operation in air-gapped environments. Acronis Cyber Protect Local provides an on-premises deployment option for isolated and air-gapped OT environments. The sections below explain how these capabilities fit into a SCADA recovery plan.

SCADA backup must fit tighter availability, change-control, compatibility and operational-impact constraints than most IT backup jobs.

Some SCADA systems support time-sensitive control functions, so backup activity has to fit the operating limits of the protected system. NIST's OT security guidance cautions that unplanned resource load from IT-style software can interfere with those functions rather than simply slowing a batch job.

SCADA hardware also stays in service much longer than typical IT hardware. PC-based OT systems running Windows XP-era or early Windows Server builds remain common in long-lifecycle industrial environments, often because the supervisory software was validated against that exact build and revalidation is costly. A backup product that no longer supports those operating systems may be unsuitable for protecting them.

Some SCADA systems also run under OEM-certified or vendor-supported configurations. Confirm compatibility, support and change-control requirements with the relevant automation vendor before installing backup software on those hosts.

A complete SCADA backup program should cover SCADA and distributed control system (DCS) servers, engineering and operator workstations, I/O servers, historians and HMIs. Capture each vendor's proprietary project and runtime files alongside the operating system image, not in place of it.

Asset inventory checklist:

• System images (OS, drivers, applications) for each in-scope SCADA server, HMI and engineering workstation
• Vendor project and configuration files (see below)
• Historian databases, logs and operational data, protected through the historian vendor's supported method
• Driver and third-party device configuration files
• Documentation of the validated OS and application baseline for each host, for use during OEM support conversations

Vendor-specific project and configuration files — including those used by Rockwell FactoryTalk, Siemens WinCC, Schneider Electric Citect/EcoStruxure, AVEVA InTouch and GE Proficy iFIX — come in proprietary formats. The files, extensions and versions required for recovery depend on the product release in use, so confirm the current list against the vendor's own documentation.

Historian protection varies by platform, database engine, site configuration and recovery objective. Follow the historian vendor's supported backup method, then validate the recovery process against site requirements.

The failure mode determines the restore method. Full-image backup supports whole-system and bare-metal recovery, while file-level restore can address limited deletion or corruption when the underlying system is still operational.

File-level backup captures documents and configuration files, but it leaves out the operating system, drivers and machine-specific settings that allow supervisory software to communicate with programmable logic controllers (PLCs). A full-image, or disk-image, backup captures the entire disk — operating system, applications and configuration — as one recoverable unit. That matters in SCADA environments still running XP-era or other legacy operating systems, where rebuilding a validated software and driver stack can be difficult. Actual recovery time still depends on image size, storage performance, target hardware and the validation steps required before the system can return to production.

Set backup frequency separately for each SCADA system, using its recovery point objective, rate of change, operational constraints, supported vendor methods and site policy. Configuration images and continuously changing historian data may need different schedules. Confirm that the selected cadence works through recovery testing.

A historian's backup cadence depends on its platform, database engine, site configuration and recovery objectives. Use the vendor-supported method and validate it against the site's requirements.

Air-gapped environments reduce exposure to internet-borne threats, but they make backup logistics harder because there is no network path to a cloud repository. They still need controls for portable and removable devices. ISA/IEC 62443-3-3 addresses this through SR 2.3, use control for portable and mobile devices, under Foundational Requirement 2.

Acronis Cyber Protect Local provides an on-premises deployment option for isolated and air-gapped OT environments. Schaeffler implemented Acronis Cyber Protect to strengthen availability and support fast recovery across its production environment without cloud infrastructure.

This article does not prescribe a step-by-step recovery sequence for a live SCADA process. Decisions about isolating, validating and reintegrating a supervisory control system are safety-critical and belong in the facility's incident-response, OEM, functional-safety and change-control procedures. A backup program should give those procedures a reliable recovery point and a clear plan for using it. Five questions are better answered before an incident than during one:

• Scope. Which PC-based OT systems are in scope for this recovery plan, and what does each one need to return to a known-good state?
• Validate. How will a restored image or configuration file be confirmed clean and correct, both technically and against physical process reality, before it goes anywhere near a live process?
• Authorize. Who is authorized to execute a recovery, and under what change-control or incident-response sign-off?
• Test. How often is the recovery path itself exercised with a live restore, not just a completion check?
• Document. How is the recovery captured afterward for audit, incident review and lessons learned?

Documenting these answers in advance reduces uncertainty when recovery begins. The actual sequence will still depend on the system, failure mode and site procedures.

When identical replacement hardware is unavailable, Acronis Universal Restore can restore a Windows or Linux image to different hardware by supplying the boot-critical drivers the target system needs. This is particularly useful when the original hardware is no longer available.

A facility can therefore redeploy a legacy SCADA environment on available hardware instead of searching for an identical discontinued part. The result still depends on the target hardware and the drivers available.

Sasol used Universal Restore to eliminate hardware-compatibility issues and migrate between virtual and physical systems while meeting compliance requirements, securing 350 terabytes of data in the process. ABB selected Acronis to support automated full-disk backup and Universal Restore across different hardware configurations.

Acronis Cyber Protect for OT is built around OT recovery priorities. Four capabilities map directly to the constraints described above:

1. Support for PC-based OT systems and legacy operating systems. The platform protects SCADA servers and clients, HMI and engineering workstations, historians and other OT application servers, including the legacy OS environments described above.
2. Local operation in air-gapped environments. Acronis Cyber Protect Local provides an on-premises deployment option for isolated and air-gapped OT environments; see the air-gapped section above.
3. Authorized local recovery. Acronis One-Click Recovery lets authorized local personnel restore a failed HMI or SCADA workstation without waiting for an IT engineer, while still operating within the site's recovery and change-control procedures.
4. Recovery to replacement hardware. Acronis Universal Restore recovers a full-image backup to dissimilar hardware, reducing dependence on sourcing an identical, discontinued part.

Acronis protects PC-based OT systems at Purdue Reference Model Level 2, supervisory control; Level 3, operations; and Level 3.5, the IT/OT DMZ.

Acronis also documents immutable storage options for OT backups, which prevent a backup from being deleted or encrypted after the fact.

Acronis's secure product-development lifecycle is certified to IEC 62443-4-1, independently validating the company's SSDLC practices as a supplier. The certification applies to Acronis's development process, not to the functional safety or security level of any specific customer deployment.

Proof points: Tata Steel, an Acronis Cyber Protect customer outside the OT/SCADA context, reports improving recovery time objective (RTO) from five days to four to six hours and recovery point objective (RPO) from seven days to one day or less after adopting whole-system image backup. This is a general backup-modernization result, not a SCADA-specific one. See the Universal Restore section above for dissimilar-hardware recovery evidence.

Use the Acronis OT Downtime Cost Calculator to estimate the cost of an hour, a month or a year of unplanned SCADA downtime, then compare the current state with a faster-recovery scenario.

Try the OT Downtime Cost Calculator

Explore Acronis Cyber Protect for OT

These answers describe general OT backup practice. Confirm the details against your facility's approved incident-response, change-control and regulatory requirements before acting.

How often should SCADA backups actually be tested with a real restore, not just a completion check?

A completed backup job is not the same as verified recoverability. Integrity checks, bootability verification and restore testing can provide additional assurance. Define and document a restore-testing cadence based on recovery objectives, system criticality, site policy and applicable vendor requirements.

Does installing backup software on a SCADA workstation affect OEM support or warranty agreements?

OEM support implications depend on the automation vendor's policies and the system configuration. Confirm compatibility and support requirements with the relevant vendor before installing software on a certified host.

Should a SCADA backup program cover PLC logic and firmware, or only server- and workstation-class assets?

Both, through different mechanisms, though this article and Acronis Cyber Protect for OT focus on server, workstation and HMI backup. Coordinate protection of programmable logic controller (PLC) and remote terminal unit (RTU) assets with the automation vendor's supported engineering and lifecycle-management tools; this is general OT guidance rather than an Acronis product capability.