Backups and business continuity: what you need to know
Ask most businesses whether they have backups and the answer is “yes”. Ask when they last restored one, or how long it would take to be working again after a serious incident, and the room goes quiet. Backups and business continuity solve different problems. You need to know which is which.
Backup: getting your data back
A backup is a copy of your data that you can restore if the original is lost, deleted, corrupted or locked by ransomware. It answers: “can we get our files back?”
Business continuity: staying in business
Business continuity is about how you keep operating while something is broken. It answers: “how quickly can people work again, and how?”
If a server fails, a backup might get your data back in a day or two, once you have new hardware and have rebuilt the system. For some businesses, a day or two offline is too much. Continuity measures, such as replicating servers and key data to a secure cloud environment, aim to shrink that time.
Two numbers to agree
- Recovery point objective (RPO): how much recent work you can afford to lose. If backups run nightly, you could lose up to a day.
- Recovery time objective (RTO): how long you can afford to be down.
Ask each department head. Finance may need an RPO of an hour. A marketing team might accept a day. These numbers drive how much you spend and what you buy.
The 3-2-1 rule
A widely used guideline:
- 3 copies of your data
- 2 different types of storage
- 1 copy kept off-site
Add one more: at least one copy that attackers cannot change or delete, such as an offline or “immutable” backup. Ransomware gangs actively look for backups and wipe them. The NCSC advises keeping backups offline or otherwise protected from the systems they back up.
Do not forget cloud data
A common misunderstanding is that Microsoft 365 or Google Workspace backs up your data for you. They keep their service running and offer some recovery features, but they work on a shared-responsibility model: your data is your job. Deleted items, overwritten files and malicious deletion can be hard or impossible to recover once retention periods end. A separate backup of mailboxes, SharePoint, OneDrive and Teams data is a sensible precaution.
Test, test, test
A backup you have never restored is a hope, not a plan. Make testing routine:
- Check backup jobs daily and fix failures straight away
- Restore a few files regularly to prove the data is readable
- Do a full restore test of a key system at least once a year, and time it
- Write down what you learn. Where did it take longer than expected?
Our managed service includes daily backup checks and quarterly tests with partial restores, so problems are found before you need the data.
Write the plan down
A continuity plan does not need to be a 60-page document. Aim for a few pages that answer:
- What are our critical systems, in order of importance?
- Who is in charge when something goes wrong, and who is their deputy?
- How do we contact staff and customers if email is down?
- How do we work in the meantime, for example from home or from another site?
- Who do we call: IT provider, insurer, legal adviser?
Keep a copy somewhere that does not depend on your own systems. A plan stored only on the server that has failed is not much use. Our guide to what to do in the first hour of an incident is a good companion.
What good looks like with us
Our managed IT services include fully managed, monitored backups stored securely in the cloud, with an optional off-site copy in a secure data centre. For organisations that cannot afford long outages, managed replication copies servers and key data to a secure cloud environment. confirm backup technology, retention periods and the recovery-time claim before publishing
Backups are one part of your protection. The cyber security hub shows how they fit with certification, detection and response.
A quick self-check
- Do we know what is backed up and what is not?
- Is at least one copy protected from deletion by an attacker?
- When did we last restore something?
- Do we know our RPO and RTO?
- Is Microsoft 365 or Google Workspace data covered?
If you are unsure about any of these, talk to us about managed IT.
