Key takeaways
- Backups should cover on-premises and cloud data as well as configurations.
- RAID, snapshots and synchronisation are no substitute for an independent backup.
- Retention must reflect the company's risks and requirements.
- A recovery test is the only way to verify that a backup works.
What should be backed up?
List servers, computers, databases, documents, email, SharePoint, OneDrive, device configurations and licence keys. Identify data owners and define the maximum acceptable amount of information that may be lost.
The 3-2-1 rule and storage options
Three copies
The original and at least two copies reduce the risk of a single failure.
Two media types
A combination of disk, NAS, tape or cloud storage reduces the risk of one type of medium failing.
One off-site location
A copy outside the main location protects against fire, theft and ransomware.
Recovery tests
Establish who will restore files, a virtual machine and the most important application, and how they will do it. The test should measure time, data completeness and issues requiring correction. Document the result and repeat the scenario after major changes.
Do not trust the green icon
A successfully completed backup job does not mean the data can be restored to a working environment.
Risks and cost
Cost is affected by capacity, retention, encryption, transfer, off-site copies, Microsoft 365 backup and the required recovery time. The greatest risks are a lack of error monitoring and no designated person responsible.
Action plan
- Identify critical data.
- Define RPO and RTO.
- Choose media and locations.
- Configure encryption and retention.
- Enable error alerts.
- Perform and document recovery tests.
Checklist
- We know which data is critical.
- Copies are stored in different locations.
- Microsoft 365 backup has been assessed.
- Errors generate an alert.
- Copies are protected against deletion.
- Recovery has been tested.
Frequently asked questions
Is RAID a backup?
No. RAID increases disk availability, but it does not protect against deletion, encryption or user error.
How often should recovery be tested?
The frequency depends on how critical the data is; important systems should be tested regularly and after changes.
Does Microsoft 365 have its own backups?
The service has retention mechanisms, but an independent backup gives you greater control over recovery.
Would you like to check whether your backup actually works?
We can analyse your company's backups, retention and recovery tests.
Let's talk about your IT