Data loss is one of those risks that businesses treat as theoretical right up until the moment it isn't. A ransomware attack encrypts everything. A server fails at the worst possible time. A member of staff accidentally deletes a shared folder and nobody notices for three weeks — by which point the auto-delete on the previous backup has long since run. In each of these cases, the business discovers what their backup strategy is actually worth.
This guide covers what a robust backup strategy looks like, the most common gaps we see in practice, and what the consequences of getting it wrong actually are.
What a Backup Is Actually For
A backup is a copy of your data that can be used to restore operations after data is lost, corrupted, or made inaccessible. That sounds obvious, but it's worth being precise: the point of a backup is recovery, not storage. Having a copy of your data that you cannot reliably restore from within an acceptable time frame is not meaningfully different from having no backup at all.
This distinction matters because many businesses conflate having a backup process with having a working recovery capability. Backup creation is only half the equation. The other half — backup testing, restore verification, and recovery planning — is where most SMEs fall short.
The 3-2-1 Rule
The 3-2-1 rule is the most widely referenced framework for backup strategy, and for good reason — it's simple, effective, and resilient against the most common failure scenarios.
- 3 copies of your data: Your live data, plus two backups. Not one backup — two. This protects against the scenario where your backup itself is lost or corrupted.
- 2 different storage media: Store copies on at least two different types of media or location. Local backup to a NAS device plus cloud backup, for example. This protects against a single-point failure.
- 1 copy offsite: At least one copy must be in a different physical location to your primary data. Cloud backup satisfies this. Tape sent to an offsite vault satisfies this. A backup drive kept in the same office as the server does not.
Businesses that follow the 3-2-1 rule have genuine resilience against the most common data loss scenarios: hardware failure, ransomware, fire, theft, and accidental deletion. Businesses that have a single backup to a device in the same room as their server have a false sense of security.
A note on ransomware: Ransomware specifically targets backups. Modern ransomware variants are designed to find and encrypt backup files and shadow copies before triggering the main encryption payload. If your backup destination is a network-attached drive that is always connected and visible to your systems, ransomware can encrypt that too. Effective ransomware protection requires backups that are either offsite, immutable (write-once storage that can't be overwritten by malware), or both.
How Often Should You Back Up?
The answer depends on how much data loss your business can tolerate — a concept called Recovery Point Objective (RPO). If a full data restore happens right now and you restore from a backup taken 24 hours ago, you lose 24 hours of data. Whether that's acceptable depends entirely on what your business does.
A useful way to think about it: if you lost everything created or changed since your last backup, how much work would that represent? How long would it take to recreate? What would be lost permanently?
- Continuously updated cloud data (emails in Microsoft 365, files in SharePoint) — already backed up as you work, though this isn't the same as a separately managed backup; see below.
- Business databases, CRM, accounting software — should be backed up at minimum daily, ideally more frequently if your transaction volume is high.
- File shares and shared drives — daily backup is a reasonable baseline; if files change heavily throughout the day, consider more frequent incremental snapshots.
- Email — daily backup through a dedicated email archiving solution, separate from your mail platform's own retention policies.
The Microsoft 365 Misunderstanding
This is possibly the single most common backup gap we encounter. Many businesses believe that because their emails and files are in Microsoft 365 — which is Microsoft's cloud, with Microsoft's infrastructure — their data is backed up. It isn't, not in the sense that matters.
Microsoft 365 provides high availability, meaning the service is designed to stay up and your data is replicated across datacentres to prevent loss from infrastructure failure. But Microsoft is not responsible for data you accidentally delete, data corrupted by a misconfigured sync, or data encrypted by ransomware running on a device with an active 365 connection. Microsoft's retention policies have limits, and those limits are not configured to your business's recovery needs.
A separate, third-party Microsoft 365 backup — services like Veeam, Datto SaaS Protection, or Acronis — takes daily snapshots of your Exchange mailboxes, SharePoint sites, and OneDrive content and stores them independently from Microsoft's infrastructure. That's what gives you genuine recovery capability, including point-in-time restore to before a problem occurred.
Real example: A professional services business in Nottingham discovered that a member of staff had been gradually moving files out of a shared project folder over several months — not as malicious action, but through repeated accidental drags into incorrect locations. By the time the issue was noticed, the original folder structure was gone, and Microsoft's 93-day recycle bin retention had long expired. With a proper third-party 365 backup, point-in-time recovery would have restored the folder to any point in the previous year. Without one, the files were gone.
Recovery Time Objective: The Other Half of the Equation
Alongside Recovery Point Objective (how much data you can lose), your backup strategy needs to account for Recovery Time Objective (RTO) — how long you can be without systems before the business is seriously affected.
A backup on an external hard drive might be complete and current, but if restoring from it takes 48 hours, and your business cannot operate without those systems for 48 hours, the backup strategy has failed even though the backup worked. RTO needs to be part of the planning conversation, not an afterthought.
Modern cloud-based backup solutions can dramatically reduce recovery times because they allow you to restore to a cloud environment immediately while your local systems are recovered — a capability called disaster recovery as a service (DRaaS). For businesses with a low tolerance for downtime, this is worth understanding.
Testing: The Part Nobody Does
A backup that has never been tested is not a backup — it's an assumption. Backup media degrades, backup jobs fail silently, restore processes fail due to configuration drift, and the data you think is being backed up turns out to have been excluded from the scope. None of this is apparent until you try to restore.
Best practice is to run a test restore quarterly — actually restoring data from backup to a test environment and verifying that what comes back is complete and usable. Many businesses have never done this. The ones that have are often unpleasantly surprised by what they find.
If your IT provider manages your backups, ask them when the last test restore was run and what the result was. If they can't give you a clear answer, that's important information.
A Simple Self-Assessment
Ask yourself the following questions. If you can't answer them confidently, your backup strategy has gaps worth addressing:
- Where are your backups stored, and is at least one copy offsite?
- How old is your most recent backup right now?
- Is your Microsoft 365 data backed up by a third-party solution, separate from Microsoft's own retention?
- If ransomware hit today, would your backups be affected, or are they stored in a way that's protected from your main network?
- When was the last time you ran a test restore to verify the backups actually work?
- If you had to restore everything from backup right now, how long would it take and who would manage the process?
Backup is one of those areas where the cost of getting it right is modest and predictable, while the cost of getting it wrong can be existential. The businesses that treat it seriously, test it regularly, and understand their recovery capability are the ones that survive data loss events. The ones that assume the backup is fine find out otherwise at the worst possible moment.