Backup and recovery: a grounded overview

Backup decides whether a bad day costs money or ends the business. It is also the control most often believed to be running when it is not, because the failure is silent. A job reports success for two years, and nobody finds out until the morning they need it.

What to take away

Where this sits against everything else

Backup sets the floor on how bad the worst version gets. The sequence in security foundations puts it above anything you can buy.

The account that runs it needs the protection identity and access describes for privileged logins. Taking the data and the recovery at once is the point of attacking it.

Copies that live only on a laptop belong with the device work in endpoint security.

The United States Cybersecurity and Infrastructure Security Agency's ransomware guide states that recovery capability is targeted deliberately and early. That is why separation matters more than the schedule.

What each threat actually needs

Answer this first. A setup that handles one threat can be useless against the next.

Ransomware dictates the design, because the attacker hunts backups before doing anything visible. A victim who can restore has no reason to pay.

A backup handling the first two rows and none of the others is what most businesses have. The gap between that and a survivable setup is smaller than it looks.

The copy that saves you

Keep more than one copy, on more than one kind of storage, with at least one held away from the working environment.

For a small business that usually means three things. Something continuous and convenient for everyday mistakes: file history, versioning, a local appliance. Something offsite and automated, typically a backup service such as Backblaze, Acronis Cyber Protect, Veeam or MSP360. And something a compromised environment cannot reach.

The third copy has one of these properties:

If none of your copies has one of those three properties, fix that before buying any new security product.

How far back retention has to reach

Further than most people set it, for a specific reason. Intrusions are often discovered long after they began. Short retention means every copy you hold already contains the intruder's access, and restoring reinstates the problem.

Keep a longer tail than feels necessary: 30 daily copies, 12 weekly and 12 monthly, which reaches back about a year for most businesses. Some records need longer, which the last question covers. Old, infrequent copies are not the expensive part.

What a restore test proves

A green status light proves the job ran. It does not prove the data opens.

The quarterly routine that keeps this honest

Four things, about an hour between them. Everything else on this page is theory until somebody does these.

Once a year, make the first item a whole share or a whole machine, and time that too. That number governs every other decision here.

Cloud services and the export nobody holds

Your provider protects against their own failure, not against your deletion, a departing employee's cleanup, or changes made with valid credentials. The reasoning is in cloud security.

Check what recovery each service offers: how long a deleted item is retrievable, whether previous versions are kept and for how long, what happens if the subscription lapses. Where a service holds records you cannot recreate, an independent copy outside the platform is worth arranging.

Recovery order and who holds the delete key

Decide the order before the incident, because during one the pressure is to restore whatever is shouted about loudest. Identity and authentication usually come first, then the systems the business cannot trade without, then everything else.

Write it on one page: which system holds which data, who owns each, and the order. Keep that page where your systems cannot reach it, printed or on a device off the network you are recovering.

A plan stored only inside the environment being recovered is a plan you will not have.

The rest of the sequence is in incident response.

Give the backup system its own account with its own MFA. Do not reuse the domain or tenant administrator. Deleting backups often comes before the visible part of a ransomware incident, so treat it as an alarm.

Common questions

How much data can we afford to lose, and how long can we be down?

Two separate questions, answered per system. The first sets backup frequency: if losing a day of invoices is tolerable, daily works. The second sets the recovery method, because restoring files over the internet is slow. The accounting database and the archive of old marketing images do not deserve the same treatment.

A sample table for a four system business. The figures are typical starting points, not targets:

Set your own numbers first, then buy the storage and the speed that the tightest row demands.

Do we need a local copy if we already back up to the cloud?

Often yes, for speed. If the business stops when a particular system stops, a local copy restores in hours where an internet restore takes days. Keep the offsite copy as well; the local one shares a building with the thing it is protecting.

What are the common failures?

The job failing for months because nobody reads the emails. The external drive left permanently connected. Retention reaching back two weeks. The key stored only on the lost server. The scope that never included the new file server. The cloud service everyone assumed the vendor backed up. Every one is caught by the quarterly test.

What does the law require of us?

The United States Federal Trade Commission publishes general data security guidance for businesses. What retention or recovery your industry or contracts require is specific to your jurisdiction, and should come from your own legal advisers.

Sector rules are published, so you can check them before paying for advice. The HHS Office for Civil Rights covers health records under HIPAA, the PCI Security Standards Council covers card data, state insurance and financial regulators cover those industries, and the IRS publishes how long to keep business tax records.

A trade association usually restates the same rule in plainer terms.