What "Backed Up" Should Actually Mean for Your Business

Ask a business owner whether they're backed up and the answer is almost always yes. Ask when the last successful restore was tested and the answer changes shape considerably.

That gap is where the losses happen. A backup nobody has restored from is a belief, not a safeguard — and it's the kind of belief that only gets tested on the worst day.

Sync is not backup

This is the most consequential misunderstanding, and the most common. OneDrive, Google Drive, Dropbox, and iCloud are sync services. They make the same files available everywhere, which is genuinely useful and not the same thing.

The problem is that sync faithfully reproduces destruction. Delete a file and it disappears everywhere. Ransomware encrypts your files and the encrypted versions sync to the cloud within seconds. The service did exactly what it promised.

These services do offer version history and a recovery window, which has saved plenty of people. But it's typically limited, sometimes shorter than the time it takes to notice a problem, and it isn't designed for restoring an entire business at once.

The 3-2-1 rule, and why the 1 matters most

Three copies of your data, on two different types of media, with one kept offsite. It's an old rule that has aged well.

The offsite copy is the part that earns its keep, and modern ransomware has added a twist: it should ideally be offline or immutable, not merely elsewhere. Attackers now deliberately hunt for and encrypt backups before triggering the visible attack, because a business with working backups doesn't pay. A backup drive permanently plugged into the server it protects is on the same network as the attacker.

What actually needs backing up

Most backup plans cover file servers and stop. The list is usually longer than people expect:

• Files and shared drives — the obvious one
• Email — Microsoft 365 and Google Workspace replicate for availability, not to protect you from deletion; both recommend third-party backup and neither provides it by default
• Accounting and line-of-business systems — often the most painful thing to lose and the least often included
• Databases — which need a proper dump, not a file copy of something in use
• Configuration — router, firewall, and server settings, so rebuilding doesn't mean rediscovering
• Cloud applications — CRM, project tools, anything holding data you couldn't recreate
• Individual laptops — where more real work lives than anyone admits

Decide two numbers before choosing anything

How much data can you afford to lose, measured in time? If your backup runs nightly, a failure at 4pm loses a full working day. That's fine for some businesses and unacceptable for others.

And how long can you afford to be down? Restoring a large amount of data over a normal internet connection can take days. If that's intolerable, you need a local copy to restore from quickly, with the offsite copy as the fallback.

These two numbers determine what you need and what it costs. Choosing a product first and discovering the numbers afterwards is the expensive order to do it in.

Test restores, or you don't have backups

Backups fail quietly. A job that stopped running months ago often looks identical to one that ran last night unless someone checks. Silent failure is the normal failure mode, not an unusual one.

• Restore a single file monthly — takes minutes and catches most problems
• Restore something substantial quarterly, and time it, so your recovery estimate is measured rather than assumed
• Confirm the restored data actually opens and is complete, not just that the job reported success
• Check that the backup covers what you think it covers — new systems get added and rarely get included

The short version

Sync isn't backup, email needs backing up too, one copy should be offline or immutable, and an untested backup is an assumption. The quarterly test restore is the single highest-value thing on this list.

If you're not certain what's covered or when a restore was last tested, that's worth checking before you need the answer. Our free IT audit will give you a rough read in about two minutes.