Back up company data without risk

What good corporate data backup really means

A reliable backup is not limited to a copy on an external drive or a synchronized folder in the cloud. True corporate data backup includes policy, schedule, separate copies, access control, recovery verification and clearly defined responsibilities.

This is where confusion often arises. Synchronization keeps content up-to-date between two locations, but if a file is deleted, encrypted or corrupted, the problem can spread anywhere. An archive is useful for storing information, but it is not always sufficient for a quick return to a working state. A backup solution should be focused on recovery, not just storage.

For a manager or COO, this comes down to three questions. What is critical to the business, how much data can they afford to lose and how long it will take to get the systems back up and running. Without answers to these questions, even the most expensive solution may not be suitable.

The most common weaknesses in the backup environment

Many companies rely on solutions that seem sufficient until an actual recovery is required. A typical example is a local NAS without a separate copy outside the office. In the event of theft, fire, power surge or ransomware, the risk remains too high.

Another common weakness is the lack of prioritization. Everything is backed up, but without a clear distinction between critical and secondary data. This results in inefficient use of capacity, extended backup windows and slower recovery.

The opposite problem is also encountered - only file servers are backed up, but cloud services, user devices or key system configurations are missed. If the environment includes Microsoft 365, virtual machines, local servers and remote employees, the backup strategy must cover the whole picture, not just part of it.

The riskiest scenario is when no one checks whether the copies are recoverable at all. A successful backup report does not always mean a successful restore. It is the recovery test that shows the real quality of protection.

How to Determine the Right Model

There is no one-size-fits-all approach that is equally good for every organization. A small accounting firm, a manufacturing company, and a team with an all-cloud environment all have different risks, different pace of work, and different costs of disruption.

Typically, the most reliable approach combines local and remote backup. Local backup provides faster recovery from everyday incidents, while remote backup protects against more serious events. This is a balanced model because it combines speed and resilience. A local-only solution is cheaper in the short term, but leaves significant risk. A cloud-only solution is convenient, but with large volumes of data, recovery can take longer.

How often the backups are created also matters. If the sales team updates information constantly, a nightly backup may not be enough. If the system is more static, a less frequent schedule may be completely reasonable. A good practice is to follow the real rhythm of the business, not the convenience of the provider.

How backup works in practice

The process begins by identifying data with operational value. This typically includes file servers, documents on cloud platforms, accounting systems, CRM data, email, virtual machines, and key system configurations. Not all information is equally critical. An order database might require hourly backups, whereas an archive of older projects might only need to be copied once a day.

Backup software monitors the selected sources and saves copies according to a pre-set schedule. Data is transferred to a separate location-such as an office network drive, a data center, or secure cloud storage. When needed, an administrator can select a specific point in time to restore a file, folder, database, virtual machine, or an entire server.

A high-quality system does more than just copy data. It verifies successful task completion, monitors for unusually small backup volumes, and sends notifications in the event of an error. This ensures problems are detected the day they occur, rather than during an actual incident when it is already too late.

Full, incremental, and differential backups

A full backup contains all selected data. While convenient for restoration, it requires more time and storage space. Consequently, it is usually performed periodically-for example, once a week or once a month.

An incremental backup contains only the changes made since the last backup. It is fast and efficient, making it suitable for frequent backups. However, during restoration, the system must combine the full backup with the subsequent changes. A differential backup stores all changes made since the last full backup. It takes up more space than an incremental backup, but recovery is often easier. There is no single "correct" option; the approach depends on the volume of data, the allowable backup window, available internet connectivity, and the required recovery speed.

Backup is not the same as synchronization

Companies often assume that if their files are synchronized between a laptop and a cloud platform, they have a backup. Synchronization is useful for collaboration, but it does not always protect against data loss.

If a user deletes a folder and that deletion is synchronized, the change may propagate to all connected devices. If ransomware encrypts files, the encrypted versions may also be synchronized. While version history in some cloud services helps, there are limitations regarding retention periods, the number of versions, and the types of data that can be restored.

A true backup involves a distinct data retention policy and the ability to restore data to a specific point in time. It is designed not for editing convenience, but for incident recovery.

Two metrics define the level of protection

Backup strategies must align with two business metrics: RPO and RTO. RPO (Recovery Point Objective) indicates the maximum amount of data loss that can be tolerated over time. If a backup runs once daily, an incident occurring at the end of the day could result in the loss of up to 24 hours' worth of changes.

RTO (Recovery Time Objective) indicates how quickly the system must be restored to availability. For an email system, file server, or sales platform, this might mean a timeframe of a few hours. For less critical archives, restoration by the next business day might be acceptable.

These metrics should be agreed upon with management rather than determined solely by the technical team. The business is best positioned to know which systems are critical to invoicing, customer service, or production processes. The IT team translates this need into a workable schedule, capacity, and recovery procedure.

Cloud or local backup

When local backup is a strong choice

Local backup has a very serious advantage when restoring large file systems, virtual machines and work environments that need to be returned in a short time. If, for example, an accounting system, file server or database needs to be restored within hours, a local copy is often the most practical option.

It also gives greater control over the infrastructure. The internal IT team or an external partner can directly manage schedules, retention policies, encryption and recovery tests. For organizations with stricter requirements for performance and control, this is important.

But local backup also has weaknesses that are often underestimated. If the backup device is in the same office, it is exposed to the same risks - fire, power surge, theft, flood, human error or ransomware that also reaches the backup environment. Many companies believe that they are protected until it turns out that both the primary and backup environments are affected at the same time.

There is also an operational issue here. Local backup is not just a plug-and-forget device. It requires monitoring, capacity planning, hardware replacement, error checking, restore tests, and clear accountability for who is monitoring the process. Without this, local backup often exists only on paper.

When cloud backup provides better protection

Cloud backup is particularly suitable when an organization wants geographical separation of data and higher resilience in the event of serious incidents. If the office becomes temporarily unusable or the local infrastructure is compromised, the backup copy remains outside the affected environment.

This is also a strong argument for protection against ransomware. If the backup architecture is properly built, with isolated storage, access control, and immutability features, the probability of malicious code destroying backup copies is significantly lower. For many companies, this is the difference between a short outage and a prolonged crisis.

The cloud model also brings better predictability in expansion. As data volumes grow, there is no need to buy new on-premises equipment every time. This makes planning easier, especially for companies with more than one office, hybrid work, or systems located in different environments.

The downside is mostly related to the speed of recovery and the dependence on internet connectivity. If you need to restore a large volume of data, the cloud is not always the fastest option. In addition, the monthly costs seem convenient at first, but with large volumes, long retention, or frequent restore operations, they can increase significantly.

The smartest choice for most companies is hybrid

For most organizations, the question of “cloud backup or local” does not end with a clear “or”. The most effective model is a combination of the two. A local copy for quick recovery and a cloud copy for protection in the event of a major incident.

This is a practical approach because it combines speed and resilience. When an employee deletes an important folder or a server crashes, a local backup helps to quickly restore. When there is ransomware, a site-wide failure or a problem with the local backup infrastructure, a cloud copy provides a second line of defense.

The hybrid model is especially suitable for companies that depend on daily access to files, ERP, mail, virtual machines and customer data. It allows for more precise policy - different levels of protection for different systems, instead of a one-size-fits-all approach.

What exactly gets backed up

File and Folder Backup

This is the most recognizable type of backup. It involves copying specific file servers, shared folders, user data, and work documents. This approach is effective when the primary risk is file loss and when applications do not require a specialized recovery procedure.

The limitation is that restoring files does not automatically restore the operating system, settings, applications, and dependencies. If a key business process runs on a database server, a file-level backup alone may not be sufficient.

System and Virtual Machine Image-Based Backup

Image-based backup creates a copy of an entire system-including the operating system, applications, configurations, and data. In virtual environments, an entire virtual machine can be backed up and restored to the same or another compatible host. This significantly reduces downtime in the event of a server failure.

This type of backup requires more storage space and careful planning, but the benefit is clear: a functional environment is restored, not just individual documents. For accounting, ERP, CRM, or production servers, this often makes the difference between a brief interruption and days of manual reconfiguration.

Database and Application Backup

Databases change constantly and should not be treated like ordinary files. Copying a database at the wrong moment can result in incomplete or inconsistent data. Systems such as ERP, CRM, accounting software, and specialized applications require "application-aware backup"-a process that accounts for the service's state and ensures successful recovery.

Backup frequency should align with business risk. For an order-processing database, a nightly backup might result in unacceptable data loss. In such cases, more frequent transactional backups or replication are scheduled, balancing costs, system load, and acceptable risk levels.

Backing Up Microsoft 365 and Other SaaS Platforms

Files in SharePoint and OneDrive, Exchange Online emails, and Teams conversations constitute corporate data. There is a common misconception that the platform automatically retains every version indefinitely and protects against every user error. While the provider ensures service availability, the organization remains responsible for its own data, retention periods, and recovery processes.

Maintaining a separate backup of the SaaS environment provides control in scenarios involving accidental or malicious deletion, expired retention periods, departing employees, or the need to restore specific emails and files. This should be part of the overall backup strategy rather than excluded simply because the data resides "in the cloud." For what exactly Microsoft keeps, for how long and when data is lost, see Microsoft 365 backup.

Immutable and Isolated Backups Against Ransomware

Ransomware is no longer limited to standard work files. Attackers deliberately target backup servers, administrator accounts, and cloud storage to eliminate any possibility of recovery. Therefore, a secure backup setup must include at least one copy that cannot be modified or deleted for a predetermined period-an immutable copy.

Isolated copies that are not constantly accessible from the production network are also valuable. These could reside in a separate environment, on offline media, or in storage accessible only via strictly restricted credentials. Isolation does not eliminate the need for monitoring, but it significantly reduces the likelihood that a compromised administrator session could destroy all backups.

A practical starting point is the 3-2-1-1-0 rule: three copies of data, on two different types of media, one copy stored off-site, one immutable or offline copy, and zero undetected errors following backup job verification. This is not a one-size-fits-all solution, but rather a risk-mitigation discipline.

Archiving and Long-Term Storage Are Not the Same

In everyday practice, the term "archiving" is often used to refer to any copy of information. However, there is an important distinction. A backup serves to facilitate rapid recovery following a system crash, user error, cyberattack, or hardware failure. Backups are created frequently and usually retain multiple versions of the data.

A long-term archive stores inactive information that must remain accessible for a specific period-such as accounting documents, contracts, correspondence, or records subject to regulatory requirements. While storage costs may be lower, such archives are not necessarily designed to restore an entire working environment within hours.

For a business, these two functions often need to operate in parallel. Documents from five years ago might reside in a long-term archive, while current files, virtual machines, and databases are protected by frequent backups.

The 3-2-1 Rule and Why It Still Works

The classic 3-2-1 rule remains relevant because it is practical. Three copies of the data, on two different types of media, one of which is outside the main location. It does not solve everything by itself, but it provides a solid foundation.

Today, two more requirements are often added to this - one copy must be unchangeable and access to the backup system must be strictly limited. The reason is simple. In modern attacks the goal is not just to stop work, but to destroy the possibility of recovery. If the attacker reaches the backup infrastructure, the damage becomes many times greater.

Therefore, the backup environment should not be treated as a secondary system. It is part of the company's defense architecture and must be monitored, segmented and documented.

How to choose a cloud backup solution: 4 criteria

1. Recovery time, not just backup time

Many providers talk about how often backups are made. This is important, but for businesses, the question of how long it will take to get back to work is more important. If the ERP system, shared folders or accounting server are unavailable for a whole day, the damage often exceeds the cost of the service for years to come.

Therefore, when choosing a cloud backup solution, the RPO and RTO parameters should be checked. RPO shows how much data you can afford to lose in a time range. RTO shows how long you can be without a system. These values are different for different services. Email can tolerate one thing, and a production system - completely different.

2. Scope of protection

Not every solution covers all environments equally well. There are platforms that are strong in Microsoft 365, but with more limited capabilities for on-premises servers. Others are excellent for virtual machines, but weaker when backing up endpoint devices or SaaS data.

Therefore, the right question is not “is there cloud backup”, but “what exactly from our environment is included”. In many companies, critical information is distributed across file servers, user laptops, SharePoint, Exchange, OneDrive, and business applications. If only part of this picture is protected, the risk remains.

3. Security of the backup itself

The archive is the last line of defense. If it is weak, the entire recovery plan is compromised. Good practice includes encryption during transport and storage, separate access rights, non-deletable copies, and protection from ransomware scenarios.

There is an important nuance here. Some solutions look secure on paper, but have too broad administrative access or insufficient isolation between the production environment and the backup infrastructure. This is a risk because if administrator accounts are compromised, the attack can also affect the archive.

4. Visibility and accountability

For a manager or COO, “backup exists” is not enough information. Clarity is needed on what is being backed up, when was the last successful job, are there any missed devices, what are the retention policies, and when was the last recovery test conducted.

This is where the difference between a product and a managed service becomes apparent. Software by itself does not guarantee control. Someone has to monitor, react to errors, change policies for new systems, and validate the recovery. Otherwise, the company relies on assumptions.

What a working policy should include

The technical solution is only one component. To work reliably, backup of company data must be bound by a clear policy. It defines which systems are in scope, what are the retention periods, who has the right to request a recovery and how changes are documented.

This is where businesses benefit the most from discipline. When there is a formalized process, there is no dispute over who is responsible, there is no improvisation in the event of an incident and there is no dependence on one person who "knows how it's done". This is especially important in growing organizations, where the environment changes quickly and data is distributed across offices, devices and cloud services.

The policy must also reflect regulatory requirements. For some companies, retention periods, traceability and access control are not just good practice, but an obligation. In such cases, the backup solution must be tailored not only to IT needs, but also to security, audit and compliance requirements.

Recovery is the real test

The most valuable question is not "Do we have a backup?" but "How quickly and accurately can we recover?" If restoring a server takes a whole day, and the business can only tolerate an hour of downtime, there is a problem, even if the archive formally exists.

Recovery tests should be planned, not just incident response. Good practice includes periodic checks of individual files, mailboxes, entire virtual machines, and critical applications. Only in this way can you see whether the order of priorities is correct and whether the procedure works under pressure.

This is where the value of structured external support also becomes apparent. When the backup environment is monitored, reports are reviewed, failed tasks are removed in a timely manner, and restore scenarios are tested regularly, the risk is significantly reduced. This is different from the approach where someone "looks over" the system from time to time.

How we protect our clients' backups

In the Standard and Professional plans we set up and check the client's backups. They can be kept on your own server or in our own infrastructure in Bulgaria: Ceph distributed storage with three copies of the data and a separate backup site connected by dark fibre (storage with us is paid separately). An example from practice: recovering data from a failing NVMe SSD.

What to review this week

If your organization has been left on autopilot so far, the first step is not necessarily to change the technology. It is more reasonable to review the current state. Which data is critical, where is it stored, how often is it copied, where are the copies kept, and when was the last real restore test done.

If there is no answer to even one of these questions, you probably do not have a backup strategy, but a set of separate practices. This does not mean that the environment is broken. It means that there is a need for arrangement, standardization, and better control.

For some companies, optimization of the existing solution will be sufficient. Others will require a more serious redesign - especially if there is a mixed infrastructure, high dependence on cloud services or increased compliance requirements. In such cases, an external partner with a helpdesk process, monitoring and expertise in infrastructure, security and recovery can speed up the right decision-making and reduce operational risk.

Backup does not bring visible effect on the day when everything is working normally. Its value is seen in the moment when something stops and the business must continue without chaos. That is when a well-planned backup turns from a technical task into a management decision with direct results.

Let's talk about your backups: we will review what is backed up and where and suggest the best solution and price. Contact us.