“We have backups” is one of the most common answers we hear when we ask a business how it would cope with ransomware or a failed server. Backups are essential, but they answer only part of the question. The rest is how quickly you can get working again, and whether anyone has ever tried.
Backup: copies of your data
A backup is a separate copy of your data, kept so it can be restored after deletion, corruption or an attack. A good backup is:
- Separate from the original, so the same failure cannot take out both
- Versioned, so you can go back to how things looked last Tuesday rather than only last night
- Protected from deletion, ideally immutable, so nobody, including an attacker with admin access, can erase it early
- Tested, because a backup that has never been restored is an assumption
Disaster recovery: getting systems running again
Disaster recovery is the plan and the capability to bring systems back: servers, business applications, email, file access and the network. It answers practical questions. Where do we restore to if the office server is gone? In what order do systems come back? Who does the work, and how long will it take?
Business continuity: keeping people working in the meantime
Business continuity covers how staff keep serving customers while recovery happens: working from home, forwarding the main phone number, falling back to manual processes, and telling customers what is going on. A cloud phone system and Microsoft 365 make this far easier than it used to be, but only if the plan is written down before it is needed.
Two numbers that shape everything: RPO and RTO
- Recovery point objective (RPO) is how much data you can afford to lose, measured in time. If you back up once a night, a failure late in the afternoon loses most of a day of work.
- Recovery time objective (RTO) is how long you can be without a system before it seriously hurts the business.
The right numbers differ between businesses and between systems. An accounting practice in tax season may tolerate almost no downtime on its practice management software, while the same firm could live without its marketing folder for a week. Setting RPO and RTO for each system tells you how often to back up and how much to spend on recovery.
The 3-2-1 rule, updated
The classic rule is three copies of your data, on two different types of storage, with one copy off-site. Ransomware has added two more parts, often written as 3-2-1-1-0: one copy offline or immutable, and zero errors when restores are verified.
Microsoft 365 is not a backup
Microsoft runs Microsoft 365 with a great deal of redundancy, so a failed Microsoft data centre is not your problem. Under Microsoft’s shared responsibility model, though, protecting your data against deletion, ransomware or a departing employee is.
The built-in safety nets are limited. Items deleted from SharePoint and OneDrive sit in the recycle bin for up to 93 days. Items deleted from Exchange mailboxes can be recovered for 14 days by default, which an administrator can extend to 30. After that, unless retention policies are configured, they are gone. A dedicated Microsoft 365 backup keeps independent copies for as long as you choose.
Ransomware changed the rules
Modern ransomware goes looking for backups before it encrypts anything. If backups are reachable from the office network with the same administrator password, they are encrypted too. Keep at least one copy immutable or offline, use separate credentials for the backup system, and protect its console with multi-factor authentication.
A checklist for small businesses
- List what you run: Microsoft 365, file servers, business applications, your website and phone system configuration
- Set an RPO and RTO for each system that matters
- Back up Microsoft 365 separately from Microsoft’s own retention
- Keep one copy immutable or off-site, beyond the reach of office admin accounts
- Protect backup admin accounts with MFA and credentials used nowhere else
- Test restores on a schedule: a single file, a mailbox and a full system, timed against your RTO
- Write down who does what in an outage, and how staff and customers will be told
If you would like help working through this list, our backup and disaster recovery service covers backups, recovery planning and scheduled restore tests. A review of your current backups is part of the free IT assessment.