Most businesses think they have a backup strategy. They're usually wrong — or at least, significantly overconfident in what they have. We see this regularly when onboarding new clients: backups that haven't been tested in years, backup software that silently failed months ago, or backups stored in the same location as the primary data they're supposed to protect.
Here's what a robust backup strategy actually looks like — and how to tell if yours falls short.
The 3-2-1 rule — the minimum standard
The 3-2-1 backup rule is the widely accepted baseline for data protection:
- 3 copies of your data
- 2 different storage media types (e.g. local drive + cloud)
- 1 copy stored offsite or in a geographically separate location
Many businesses have one copy — their live data. Some have two. Very few have all three in genuinely separate locations.
Are your backups actually completing?
Backup software fails silently. A job that completed successfully six months ago may have quietly stopped running due to a licence expiry, a disk full error, or a configuration change. Without regular monitoring and alerting, you won't know until you try to restore — which is exactly the wrong time to find out.
When did you last test a restore?
A backup you've never tested is theoretical protection. Restoring data from backup is a skill — it takes time and the process differs by system. Test a full restore at least quarterly so that in a genuine crisis, your team knows exactly what to do and how long it takes.
What's your recovery time objective?
How long can your business survive without its data? An hour? A day? A week? Your backup strategy should be designed around your Recovery Time Objective (RTO). If you need to be back online within two hours, your backup and restore process needs to be fast enough to support that — which may mean local backups for speed and cloud for disaster recovery.
Are you protected against ransomware?
Ransomware encrypts your files — including any connected backup drives. If your backup is mapped as a network drive, ransomware will encrypt that too. True ransomware protection requires immutable backups: copies that cannot be altered or deleted even by an administrator for a set period.
Syncing files to OneDrive or Dropbox is not a backup. If a file is deleted or corrupted on your device, the sync service replicates that deletion or corruption to the cloud — within seconds.
What a managed backup solution looks like
Our managed backup service monitors every backup job in real time, alerts us immediately if anything fails, and performs regular automated restore tests to verify integrity. We implement immutable cloud backups with defined retention periods so ransomware can never reach them. And we design your recovery plan before you need it.
If you're not confident in your current backup strategy, our team can audit what you have and get you to a genuinely protected position — usually within a week.