Every business we’ve ever reviewed said it had backups. Most of them did. A meaningful number of those backups could not have been restored from, and nobody knew, because restoring had never been attempted.
That gap — between having backups and being able to recover — is where the actual risk lives.
Sync is not backup
Google Drive, OneDrive and Dropbox are excellent at what they do. What they do is replicate your changes everywhere, immediately.
Ransomware encrypts your files. That’s a change. It replicates, immediately, to every device and to the cloud copy. So does a deletion, and so does an employee overwriting the master price list with a bad version.
Cloud sync services do keep version history — 30 days on most business plans — and that history has saved plenty of people. But it’s a limited safety net, not a backup strategy: it usually can’t do a bulk point-in-time restore of everything cleanly, the retention is shorter than the time it typically takes to notice corruption, and it covers only what’s in the synced folder — not your accounting database, not the server, not the mailboxes.
The distinction that matters: backup is a copy that the thing being backed up cannot reach out and destroy.
3-2-1, in real terms
The old rule still holds:
- 3 copies of your data
- on 2 different types of media
- with 1 copy off-site
For a typical small office, that’s concretely:
- The live data — on the server or workstations
- A local backup — a NAS or a dedicated backup disk, so that recovery from the common cases (deleted file, failed drive, bad edit) takes minutes rather than days
- An off-site copy — cloud backup, or rotated encrypted drives that physically leave the building
Modern practice adds a fourth requirement: at least one copy must be immutable or
offline — write-once cloud storage, or a disk that is genuinely disconnected. Ransomware
now specifically looks for reachable backup shares and encrypts those first. A backup
drive permanently mounted as B:\ is one of the things it will find.
The two numbers you need to decide
Before choosing tools, answer these two questions about your business, in numbers:
RPO — how much data can you afford to lose? If backups run nightly at 2am and the server dies at 6pm, you have lost a working day. For a design studio that’s irritating. For a business that takes payments, it may be unacceptable, and you need something continuous instead.
RTO — how long can you be down? “We restore from cloud backup” sounds fine until you work out that 800 GB over your office connection is a two-day download. If you need to be running the same day, you need a local copy to restore from, and the cloud copy is only for the building-burns-down case.
Every real backup decision follows from those two numbers. Most businesses have never been asked them.
The test
Once a quarter, pick a file from three months ago and restore it. Then, once a year, do the real one: restore a whole system to spare hardware or a VM and see whether it comes up.
This is dull, and it is the entire point. A restore test is the only thing that distinguishes a backup system from a backup-shaped expense. It’s also how you find out that the database was being backed up as an open file and the copies are unusable, or that the backup job has been silently failing since a password change in March — both of which are things we have actually found this way.
If you do one thing after reading this: try to restore something. Today. It’ll take twenty minutes and you’ll learn something true about your business.
Backup & recovery covers how we set this up, including the restore testing.