Everybody has backups until they need to restore one. The difference between a bad day and a bad month is usually whether anyone tested the restore before it was needed.
This guide covers the decisions to make first, what needs backing up and the questions to ask a backup provider.
Decide two numbers first
How much data can you lose?
Called the recovery point objective. If losing a full day of work is acceptable, nightly backups may be enough. If losing an hour is not, you need more frequent copies.
How long can you be down?
Called the recovery time objective. Restoring a single file takes minutes. Rebuilding a whole server from a cloud copy can take far longer unless the system is designed for it.
Follow the 3-2-1 rule
Keep three copies of important data, on two different types of storage, with one copy offsite. Then add one copy that cannot be changed or deleted for a set period, often called immutable. That last copy is what lets you recover after ransomware, which often goes after backups first.
Microsoft 365 needs its own backup
Microsoft keeps the service running and keeps deleted items for a limited time. That is retention, not a backup you control. A separate Microsoft 365 backup protects you from accidental deletion past those limits, files encrypted on a laptop and synced to OneDrive, and data lost when an account is removed.
What to back up
- Microsoft 365 or Google Workspace: email, OneDrive, SharePoint and Teams
- Servers, NAS devices and any shared drives still in the office
- Business applications, including how to export data from cloud apps
- Laptops, if anyone still keeps files only on their device
- Firewall and network settings, so the office can be rebuilt quickly
Test the restore
Restore a file each quarter
Pick a file at random, restore it and confirm it opens. Record the date.
Run a full recovery once a year
Restore a server or a full mailbox and time it against the target you set.
Watch for failures
Someone should receive and act on failed backup alerts every day.
Write it down
A one page plan: who decides, who restores and which systems come back first.
How Level2 helps
We review what is backed up today, where it lives and how long a real restore would take, then compare backup providers against the targets you set. See our services, or read our guide to cybersecurity basics.
Questions we hear about this
No. OneDrive syncs files, so a deleted or encrypted file can sync too. It has version history and a recycle bin, but those have limits. A separate backup covers what they miss.
It depends on your industry, legal requirements and how far back you might need to go. Many businesses keep daily copies for at least a month and longer term copies for a year or more.
Many small businesses use both. A local copy restores quickly, and a cloud copy survives if the office does not.
Backup is having copies of your data. Disaster recovery is the plan and the systems that get the business running again, including how long that takes.