Every organisation we meet has backups. A surprising number have never restored from them. That distinction — between having backups and having recovery — is usually discovered at the worst possible moment, with an incident underway and the business offline.
Backups fail quietly
Backup jobs report success while quietly missing the databases that matter. Agents get disabled during maintenance and never re-enabled. The new file server nobody added to the schedule. Microsoft 365 data everyone assumed Microsoft was keeping (retention is not backup). And increasingly, attackers who gain access spend their first hours finding and encrypting the backups too — because they know that is what makes victims pay. New Zealand’s NCSC repeatedly lists unreliable backups among the basic weaknesses behind successful attacks.
What good actually looks like
The principles have not changed; the discipline is the differentiator. Keep at least three copies of important data, on two different types of storage, with one copy off-site — and in the ransomware era, at least one copy immutable or offline, where an attacker with your admin credentials still cannot touch it. Cover the whole estate, including Microsoft 365. Then define two numbers with the leadership team, in business language: how much data you can afford to lose (hours? a day?) and how long you can afford to be down. Everything technical follows from those two answers.
The habit that matters most: restore testing
A backup is a theory. A restore is a fact. Good practice is boringly simple: regularly restore real files, and periodically rehearse recovering a whole system, timing it against that recovery target you agreed. The first test almost always finds something — better in a Tuesday drill than mid-incident.
Questions for your next leadership meeting
When did we last successfully restore something? Is any backup copy truly offline or immutable? Is Microsoft 365 included? Who gets alerted when a job fails — and did anyone check this week? If those questions get vague answers, our free Security Health Check will show you where you stand, or read how backup and business continuity fits into our managed security — tested restores included, because that is the entire point.
Want this handled properly? Talk to us about Managed IT.
