NIDAVA
Most companies we meet say they have backups. Far fewer have ever tried to restore one. A backup you have never restored is a hope, not a plan.
What actually goes wrong
It is rarely a dramatic attack. A server disk fails after six years. An employee deletes a shared folder by mistake. Ransomware arrives in an email attachment and encrypts every drive it can reach, including the backup drive plugged into the same machine. In each case the question is the same: how much do we lose, and how long until we work again?
The 3-2-1 rule
Keep three copies of anything that matters, on two different kinds of storage, with one copy somewhere else. In practice: the live data, a local backup on a separate device, and an encrypted copy off-site or in the cloud. If the office floods or the network is encrypted, the third copy is the one that saves you.
The copy that saves you is the one the attacker couldn't reach.
Keep one copy out of reach
Ransomware looks for backups on purpose. A drive that is always connected, or a cloud folder that syncs every change, can be encrypted along with everything else. At least one copy should be offline or immutable, meaning it cannot be changed or deleted for a set number of days, even by an administrator.
Decide what "too long" means
Two questions set the whole plan. How much work can you afford to redo: an hour, a day, a week? That decides how often you back up. And how long can you stop working: that decides how fast the restore must be. An accounting database and an archive of old photos don't need the same answer.
Test the restore
Once a quarter, pick a real file, a real mailbox or the full database, and restore it to a separate place. Time it. Check that it opens. Write down what went wrong. That test is the only proof the backups work.
Where to start
List the systems your company can't work without: accounting, email, the shared drive, the website. For each one, write where the backups are, how often they run and when they were last restored. The empty cells are your plan.
