Almost every organization says it has backups. Far fewer know how long it would take to recover from them, or whether they'd survive a ransomware attack. A backup is a copy of your data. Recovery is getting the business running again — and that takes planning.
Two numbers every leader should know
- Recovery time objective: how long can each critical system be down before the damage becomes serious? Hours? Days?
- Recovery point objective: how much recent data can you afford to lose? The last hour? The last day?
These are business decisions, not technical ones. Once you've set them, your IT team or provider can design backups to meet them — and tell you what that costs.
Attackers target backups first
Ransomware groups know backups are your way out, so they try to find and destroy them before launching an attack. Backups that sit on the same network, using the same passwords, are often lost along with everything else. At least one copy should be offline or immutable — unable to be changed or deleted, even by an administrator.
A simple rule of thumb
Keep at least three copies of important data, on two different types of storage, with one copy offsite — and make sure one of them can't be altered. Then test that you can actually restore it.
Don't forget the cloud
Many organizations assume their cloud services back up their data for them. Providers keep their platforms running, but protecting your data — for example, from accidental deletion or a compromised account — is often your responsibility. Check what's covered for your email, file sharing and business applications.
Test recovery, not just backups
A backup report showing “successful” doesn't prove you can recover. Regularly restore real systems, time how long it takes and compare the result with your targets. Decide in advance which systems come back first.
Questions to ask your team
- When did we last restore a critical system from backup, and how long did it take?
- Could an attacker with administrator access delete our backups?
- Are our cloud services backed up, or just “in the cloud”?
- Which systems do we restore first, and who decides?
Key takeaways
- Set recovery targets as a business, then design backups to meet them.
- Keep at least one copy that attackers can't change or delete.
- Test recovery regularly — learn more about our backup and recovery service.