Why Backup Matters

Data loss happens more often than most businesses expect. Hardware fails, ransomware encrypts files, employees accidentally delete important documents, natural disasters destroy equipment. Without proper backups, any of these events can be catastrophic.

Good backup is like insurance — you hope you never need it, but when you do, it is invaluable.

Backup Fundamentals

What to Back Up

Consider all business-critical data:

Documents and filesContracts, proposals, reports, spreadsheets, presentations.

EmailCommunication history, attachments, contacts.

DatabasesCustomer records, accounting data, inventory, orders.

Application dataSettings, configurations, customisations.

System configurationsServer settings, network configurations.

MediaPhotos, videos, design files.

The 3-2-1 Rule

A minimum backup standard:

3 copies of your data (original plus two backups)
2 different storage types (such as local and cloud)
1 copy off-site (protected from local disasters)

This approach protects against single points of failure and local disasters.

Backup Types

Different approaches to capturing data:

Full backupComplete copy of all data. Takes longest but simplest to restore.

Incremental backupOnly data changed since last backup. Fast but requires multiple restores.

Differential backupData changed since last full backup. Balance of speed and simplicity.

Continuous/real-timeData backed up as it changes. Minimal data loss but resource-intensive.

Backup Technologies

Local Backup

Backup devices on-premises:

External drivesSimple, affordable, portable. Good for basic backup.

NAS (Network Attached Storage)Centralised backup for multiple computers. Good for small offices.

Backup serversDedicated systems for larger environments.

AdvantagesFast backup and recovery, no internet dependency, one-time hardware cost.

DisadvantagesVulnerable to local disasters, theft, ransomware that spreads to backup devices.

Cloud Backup

Backup to remote data centres:

Consumer servicesDropbox, OneDrive, Google Drive — sync rather than true backup.

Business backupDedicated backup services with versioning, retention, and security.

Cloud-native backupFor Microsoft 365, Google Workspace, and other cloud services.

AdvantagesOff-site protection, accessible anywhere, scales easily.

DisadvantagesDependent on internet, ongoing subscription costs, initial backup can be slow.

Hybrid Approach

Combining local and cloud:

Local for speedFast backup and recovery for routine needs.

Cloud for protectionOff-site copy for disaster protection.

Best of bothQuick recovery from local, disaster protection from cloud.

Microsoft 365 Backup

Cloud services need backup too:

Common misconceptionMicrosoft backs up your data.

RealityMicrosoft protects against their infrastructure failures, not your data loss.

What you needThird-party backup for email, OneDrive, SharePoint, Teams.

WhyAccidental deletion, malicious deletion, and ransomware can affect cloud data.

Protecting Against Ransomware

Why Standard Backup Is Not Enough

Ransomware specifically targets backups:

Attackers seek connected backup drives
Network-accessible backups can be encrypted
Synchronised cloud storage syncs the encryption
Backup credentials may be compromised

Ransomware-Resistant Backup

Protection strategies:

Air-gapped backupsPhysical copies disconnected from networks.

Immutable backupsCannot be modified or deleted, even by administrators.

Offline copiesPeriodic backups stored completely offline.

Separate credentialsBackup systems with different authentication.

Extended retentionKeep versions long enough to recover before ransomware was noticed.

Recovery Considerations

Recovery Time Objective (RTO)

How quickly you need to recover:

How long can the business operate without specific systems?
What is the cost of downtime per hour?
Which systems need fastest recovery?

Recovery Point Objective (RPO)

How much data loss is acceptable:

How much work can be recreated if lost?
What transactions or changes would be lost?
How frequently does data change?

Recovery Testing

Backups are only useful if they work:

Regular verificationConfirm backups complete successfully.

Test restoresActually restore files to verify they are usable.

Full recovery testsPeriodically test complete system recovery.

Document resultsRecord test outcomes and address any issues.

Building Your Strategy

Step 1: Inventory

Understand what you have:

What systems and data exist?
Where is data stored?
How much data is there?
How quickly does it change?

Step 2: Prioritise

Not all data is equally critical:

What is essential for business operations?
What would be difficult or impossible to recreate?
What has regulatory retention requirements?
What can be recovered from other sources?

Step 3: Define Requirements

Set your targets:

How quickly do you need to recover (RTO)?
How much data loss is acceptable (RPO)?
How long must backups be retained?
What compliance requirements exist?

Step 4: Select Solutions

Choose appropriate technologies:

Match solutions to requirements
Consider total cost of ownership
Evaluate vendor reliability and support
Plan for growth

Step 5: Implement and Test

Deploy and verify:

Configure backup systems
Run initial full backups
Test recovery procedures
Document everything

Step 6: Monitor and Maintain

Ongoing operations:

Verify backups complete daily
Review capacity and growth
Update as systems change
Test recovery regularly

Common Mistakes

Assuming Sync is Backup

Cloud sync is not backup:

Sync replicates deletions and corruption
No long-term version history
Not designed for point-in-time recovery

Never Testing Restores

Backups that cannot be restored are worthless:

Test restores regularly
Include in your procedures
Document any issues found

Backing Up to the Same Location

Keeping backups with originals:

Local backup drive next to the computer
Backup on the same server being backed up
Both destroyed by same fire, flood, or theft

Ignoring Cloud Data

Assuming cloud providers protect your data:

Microsoft 365, Google Workspace need backup
SaaS applications may have limited retention
Your responsibility, not theirs

Insufficient Retention

Keeping backups only briefly:

Ransomware may not be noticed for weeks
Compliance may require longer retention
Historical recovery may be needed

Working with IT Providers

Managed Backup Services

What providers typically offer:

Backup configuration and monitoring
Regular verification and testing
Issue resolution
Recovery assistance
Reporting and documentation

Questions to Ask

When engaging backup support:

1. What backup solution do you recommend and why? 2. How do you protect against ransomware? 3. How is backup monitored? 4. How often are restores tested? 5. What is included in recovery support? 6. What are the retention options and costs?

Good backup is fundamental to business resilience. Investment in proper backup strategy is far less than the cost of data loss.