A backup strategy is the full set of agreements about which data you copy, how often, where you store the copies, how long you keep them and how quickly you restore them. The copy itself is the easy part. Whether you are back at work within a day after an outage or attack depends on all those other agreements.
The Dutch NCSC names two trade-offs that drive every strategy (Setting up a backup strategy, in Dutch). The Recovery Point Objective (RPO) is the maximum amount of data you can afford to lose. The Recovery Time Objective (RTO) is how quickly you need to be operational again. An RPO of 24 hours means a day of work has to be redone. But the right RPO differs per organization. An RPO of 24 hours may already be too long for a logistics company, while a marketing agency might well be able to tolerate a longer RPO. In this article we won't go further into how to determine this yourself.
This is also where the difference between a backup and disaster recovery lies. The backup is your data. Disaster recovery is everything needed to make that data available again. That includes where the data is restored to, the order in which systems start up, and someone who knows how to do it. A company with perfect backups but no recovery plan will still be down for days.
And then the misconception we hear most often among SMEs: "but everything is in OneDrive, right?" Synchronization copies changes. If a file gets encrypted, that encrypted version is dutifully synced to the cloud. Microsoft does offer a safety net. Microsoft 365 subscribers can restore their OneDrive to a point up to 30 days back, for example after a malware infection. Handy. But it doesn't cover your mailbox, your accounting software or your server. And you can't go back further than 30 days.
The 3-2-1 backup rule has been the starting point for years, and the Dutch NCSC also recommends it for business owners (Back-up, maak er een zekerheid van!, in Dutch). In one sentence, this is the 3-2-1 rule for backups: three versions of your data, on two different media, one of which is kept somewhere other than your business premises.
The original counts. So you have your live data plus two backups.
Why two? Because a backup itself can fail too. A disk breaks, or a backup job has been stuck for weeks while the error message lands in a shared mailbox nobody reads (a classic). With one backup, you are left empty-handed. With two, you get a second chance.
Two folders on the same NAS are one medium. If that NAS breaks or gets encrypted, both copies are gone at once. So combine a local NAS or backup server, for fast recovery, with storage that is separate from your own network. The Dutch NCSC itself gives an external hard drive and a cloud storage service as an example of two different media.
This copy protects you against anything that hits your office all at once: fire, burglary, water damage. And against ransomware, provided it is truly disconnected from your network.
The Dutch NCSC describes how this works out in practice in a business story about Boven en Dean (in Dutch), a family office and secretarial service that handles clients' bank statements and prenuptial agreements. In February 2020 their files were encrypted, with a ransom demand in bitcoin. They had a daily automatic backup at the office and made a separate monthly backup on an external device kept outside the office, split across two drives they alternated. They didn't pay, restored their backups and were down for about a day.
Attackers know that a good backup undermines their business model. That is why they actively look for it. In research by Sophos among organizations hit by ransomware, 94% said the attackers tried to compromise their backups. In 57% of those attempts, they succeeded. The difference in damage is significant: median recovery costs were 3 million dollars when backups were compromised, versus 375,000 dollars when they remained intact. And organizations with compromised backups were far more likely to pay the ransom (67% versus 36%).
Want to prepare your organization for ransomware as well? Then read our article on ransomware in SMEs.
A targeted ransomware attack rarely starts with encryption. First the attacker looks around, gathers privileges and works out where the backups are. The Dutch NCSC writes that in recent targeted attacks "a lot of energy is put into encrypting the backups as well" (Dutch NCSC). The UK's NCSC has seen ransomware encrypt connected USB and network drives containing backups, and in some cases connected cloud storage too (NCSC UK, Offline backups in an online world).
If your administrator account can access the backup, so can an attacker using that account. A NAS mapped as a network drive on every PC is simply the next folder for ransomware. The same goes for a cloud backup whose login credentials are stored on the server.
Offline means: not reachable from your network. A USB drive that you disconnect and take with you after the backup, or cloud storage that only connects during the backup. The UK's NCSC puts it this way: with at least one backup that is offline at any given time, a single incident can never hit all your backups at once.
Immutable means that the backup cannot be changed or deleted during a fixed retention period, not even by an administrator. Many cloud backup services and newer NAS systems offer this as a setting. For most SMEs, that is more practical than swapping a drive every week.
If you want to recover your data after an attack, you need a backup you know for certain is clean. The Dutch NCSC calls this "of vital importance" (Recovering from a cyber incident, in Dutch) and advises dating your backups, so you don't accidentally restore an infected version.
Two things that are often forgotten. Give the backup environment its own admin account, separate from your regular Microsoft account, and enable MFA on it. And make sure specific people are responsible for checking the backup status every day. That way, a "backup failed" alert doesn't slip through unnoticed.
A backup you have never restored is an assumption. You only know whether it works once you have tried to restore it.
The Dutch NCSC distinguishes two types of tests (How do I test a backup?, in Dutch). In the technical test, you check whether the software reports that the backup succeeded and whether a restore also works. The functional test goes a step further: you restore a full backup and check whether you can actually work, for example by using your back-office system.
Choose a rhythm you can keep up. This is what we recommend:
Record every test: the date, what you restored, whether it worked and how long it took. That list doubles as your evidence for your insurer or auditor.
This is where most tests go wrong. Restoring a file takes thirty seconds and gives a false sense of security. The real question is how long it takes before your business is running again.
Measure it with a stopwatch. Start the moment someone says "we need to restore". Stop when an employee can create an invoice or enter an order again. Everything in between counts: finding the right backup, waiting for the download from the cloud to finish, reactivating licenses, passwords nobody remembers.
Put that time next to your RTO. Have you agreed that your accounting will be running again within eight hours, and the test takes two days? Then you have a problem you can still solve calmly now. The internet connection often turns out to be the bottleneck. Pulling a few terabytes from the cloud over a regular business line won't happen in an afternoon.
Backups protect your data. Business continuity is about whether your customers can still be served while that data comes back. The Dutch NCSC lists plans for continuity, workarounds and recovery as a fixed part of your preparation, and says you should also practice those plans (Basic principle 5, in Dutch).
Start with a list of your critical systems, ranked by their impact on your operations. Think of your email, your accounting or ERP system, your scheduling and your customer data. For each system you record two numbers: RPO and RTO. Those numbers determine how often you make a backup and how much you spend on fast recovery. That turns your backup strategy into a business decision instead of an IT setting.
A fallback scenario answers one question: where and with what do we work when the normal situation no longer exists? Write down what you do for each scenario:
Also put the recovery order on paper. First accounts and network, then email, then the systems that bring in money, then the rest. The scenarios and recovery order above are only examples. Always look at which order and scenarios apply to your own business.
The hardest moment of an incident: you want to inform everyone and your email isn't working. Neither is Teams. And guess what: your IT provider's phone number is stored in Outlook.
A communication plan doesn't need to be long. One A4 page, printed and kept in two places, containing:
The Dutch NCSC advises communicating openly and factually, including about what you don't know yet, and giving customers concrete steps they can take (Recovering from a cyber incident, in Dutch). If personal data has been affected, you also have to deal with the mandatory data breach notification. You can read more about this in our article Cyber Incident: Step-by-Step Plan for the First 24 Hours.
First of all, we should point out that we don't make or manage backups. Your IT provider or your own system administrator does that, and we won't get in between. We work alongside them.
We come into the picture before you need the backup. With Managed Detection & Response (MDR), we collect signals from your environment 24/7. MDR recognizes files being encrypted, and the sooner an attack is stopped, the less you have to restore. With MDR Premium, we respond within 15 minutes and isolate affected devices, so an infection has less chance to reach your NAS or other systems. MDR customers receive an incident response playbook in advance, so that during an incident it is already clear who does what.
Beyond our core service, we are always happy to think along when these issues come up in your organization. Also take a look at our information security page to see what else you can do to store and use your data securely.
