Backups aren't the same as recovery

Two different problems

Backing up means copying your files somewhere else. Recovery means actually getting your business running again after something goes wrong, whether that's a ransomware attack, a fire, a stolen laptop, or a failed hard drive. A business can have backups running every night and still fail at recovery, because nobody ever tried using them to bring a system back up.

The 3-2-1 approach

• Three copies of your data: the original, plus two backups.
• Two different types of storage, such as an external drive and a cloud backup service, so one kind of failure doesn't take out both.
• One copy kept separate from your main network, ideally offline or in an Immutable backup (show definition) that can't be changed or deleted even by someone with a stolen password.

Test the restore, not just the backup

A backup job that reports success doesn't guarantee the files will actually restore. Corrupted files, missing permissions, and incomplete backups often go unnoticed until someone urgently needs them. Schedule a real test restore, at least a few files and ideally a full system, on a regular basis, and write down how long it took.

Cloud email and file storage still need backup

Microsoft 365 and Google Workspace keep your data available and protect against their own outages, but they aren't a full backup of your business. If an employee deletes an email folder, a mailbox is deleted after someone leaves, or an account is compromised and cleaned out, the built-in recycle bin often has limits or time windows that run out. A dedicated backup service for these platforms closes that gap.

How long can you afford to be down

This question shapes everything else. A business that can tolerate a day of downtime has very different backup needs than one that loses money every hour its systems are down. Decide this number before an incident happens, not during one, since it changes how much you invest in fast recovery versus basic backup.

A short checklist

• Backups follow the 3-2-1 approach, including one copy separate from the network
• A real test restore has been done in the last 90 days
• Microsoft 365 or Google Workspace data has its own dedicated backup
• We know how many hours or days of downtime the business can tolerate
• At least one backup copy can't be changed or deleted, even with valid login credentials