Backups you can actually restore

“I don’t actually know if our backups would restore” is one of the sentences we hear most. Ransomware turned that uncertainty into the whole game: the attacker’s plan is to encrypt your systems and your backups, then charge you for both. Recovery costs for mid-market businesses routinely run into seven figures, and the real cost is usually the weeks of operations lost.

Three properties, none optional

Immutable. A backup that can be deleted or encrypted by an administrator account can be deleted or encrypted by an attacker who has that account, and they usually do by the time they trigger the ransomware. Immutable storage cannot be altered for a set retention period, by anyone.

Off-site. A copy in a different location and a different account, so a compromised network or tenant does not take the backup with it. Cloud-to-cloud backup counts; a second folder on the same server does not.

Restore-tested on a schedule. Restoring a file, a mailbox and a whole system, on a calendar, with the time it took written down. That number is your real recovery time, and it is the one to compare against how long the business can stand still.

Cover the things people forget

Microsoft 365 and Google Workspace are not backed up by Microsoft or Google in the sense you need; deleted mail and files age out. Databases need application-consistent backups, not just disk copies. Laptops hold work that never reached the server. Encryption at rest (BitLocker, FileVault) protects a lost device; it does not replace a backup of it.

What we run

Our managed hosting takes automated daily backups and verifies them monthly. On the security side we work with Veeam, Datto and Druva for immutable, off-site copies, and treat the restore test as part of the service, not a project. Encryption is a default; data classification only where it drives a decision.

Why it belongs in the incident plan

A backup is only useful if someone knows the order to restore things in and has the credentials to do it when the directory is down. That is what a tabletop exercise is for; see Which security framework applies for how incident response fits the rest.

The data protection layer is described on Security, and hosting backups on Managed hosting.