Backups, and Why Most of Them Do Not Work
Nearly every business believes it has backups. Far fewer have ever restored from them, and fewer still know how long it would take. The gap between those groups is where a bad week becomes a bad month.
Does it cover what actually matters?
The first question is not how much data is backed up but which data. Cloud mail and cloud file storage are the most common blind spot: businesses assume that because the data lives with Microsoft or Google it is backed up, and it is not — a subscription is not a backup. A deleted mailbox, an overwritten shared folder, an account emptied by a compromised login: the vendor’s retention window is short and their recovery tools are limited. If your business runs on cloud services, they need their own backup.
Is at least one copy out of reach?
A backup on the same network, reachable with the same credentials, is a backup an attacker can delete first. Modern ransomware does exactly that: it finds the backups before it encrypts the files. At least one copy needs to be offsite and outside the reach of an account compromise — a different system, different credentials, ideally immutable for a period so it cannot be altered even by an administrator.
Has a real restore been performed and timed?
A backup job reporting success tells you the copy was written. It does not tell you the copy can be read, that it contains what you think, or that it can be brought back in any useful time. Perform a real restore — a file, a mailbox, ideally a whole system — at least once a year, and time it. That number is your actual recovery time.
The number worth knowing
Ask not how much data you hold but how long you would be down. A day? A week? Most business owners have never been given that number, and discover it at the worst possible moment. It is knowable in advance, and once known it usually changes decisions about how the backup is designed.
What good looks like
- Cloud mail and files backed up independently of the vendor
- At least one copy offsite, under separate credentials, immutable for a set period
- A real restore performed and timed within the last twelve months
- A written recovery-time figure the owner has seen
- Someone named as responsible for checking that backups completed — every day
Backup review is part of every managed agreement we run, and it is the first thing we check when we take on an environment. If you are not sure where yours stands, ask — it is a short conversation and the answer is worth having before you need it.