Backup and recovery

Data loss rarely announces itself. It is a laptop taken from a car, a ransomware note on a Monday morning, or someone in accounts overwriting a spreadsheet three weeks before anyone opens it again.

By the time you notice, the question is no longer whether you had a backup. It is whether the backup works, how far back it goes, and how long it takes to get running again. Most businesses find out during the recovery rather than before it.

The Microsoft 365 gap

If your email and files are in Microsoft 365 or Google Workspace, you very likely do not have a backup of them, and you probably think you do.

Both providers replicate your data for their resilience. Neither protects you from a deleted mailbox discovered four months later, a compromised account that quietly wiped a shared drive, or a retention policy nobody configured. Recovery windows are shorter than people assume and they are not designed for the “someone destroyed this and we noticed in March” case.

This is the single most common real gap I find, and it is inexpensive to close.

What you can buy here

How the work runs

I start by mapping your data. What you hold, where it lives, which systems depend on it, and what matters most when something breaks. That mapping is where the surprises are. Your CRM depends on a sync job that depends on a file share nobody thought to include.

From the map we set recovery targets: how much data you can afford to lose, measured in time (your recovery point objective, RPO), and how long you can afford to be down (your recovery time objective, RTO). Those two numbers drive the design. Some data needs to be back within the hour and some can wait a day, and paying for hour-level recovery across all of it is a common way to overspend.

The design follows the 3-2-1 principle: three copies, on two kinds of storage, with one held offsite. Because ransomware now targets backups directly, at least one copy should be immutable or air-gapped, meaning it cannot be altered or deleted even by an administrator account.

Then it gets tested. A backup that has never been restored is a hypothesis, not a plan.

What I run myself, and what goes to a partner

For email and a small office on standard cloud tools, I run backup myself. Every mailbox on my email plans is backed up every night and kept separately from the email provider, so a problem at their end does not take your mail with it. That is part of the business email on Services I run.

For servers, larger setups, and anything that has to be back within the hour, I design it and set the recovery targets, a partner runs it, and I check it is doing what was agreed, restore tests included.

Who this is for

Any business that would struggle to operate for more than a day without its core systems, which is most of them. It is especially worth doing if you have never tested a restore, if you are not sure what your current backup actually covers, or if a client, insurer or lender has started asking about business continuity.

Common questions

How is this different from cloud storage or OneDrive?

Sync is not backup. If a file is corrupted, encrypted or deleted, sync faithfully propagates that to every copy. Backup keeps point-in-time versions you can go back to, and the recovery process is tested.

Do we really need to back up Microsoft 365?

In almost every case, yes. See above. It is the gap I find most often.

Can you work with our existing backup tool?

Often. I assess what you have first and build on it where it is sound, rather than replacing it by reflex.

How often should we test a restore?

At least quarterly, monthly for critical systems, and after any significant change to your systems. The test is the part that gets skipped and the part that matters.

What does this cost to run?

It scales with data volume and how fast you need to recover. Setting realistic recovery targets, rather than defaulting to the fastest option for everything, is usually where the cost is controlled.

Next step

If you are not confident your backups would carry you through a bad week, that is worth finding out before you need them. Book a 20-minute technology conversation.