Why Backups Are the One IT Investment You Can't Skip
Most businesses find out their backup strategy doesn't work at the worst possible moment, right after they need it. Here's what a real, tested backup plan actually looks like, and the mistakes we see most often.
Backups fail quietly, until they don't
A backup job can "complete successfully" for months while actually saving nothing usable, a broken permission, a filled-up drive, a database that was open and locked during the copy. Nobody notices, because nobody's tried to restore from it. The first time most businesses actually test their backup is during a real emergency: a ransomware attack, a failed hard drive, an employee who accidentally deleted the wrong folder. That's the worst possible time to discover the backup doesn't work.
The 3-2-1 rule, in plain language
This is the baseline standard for a reason, and it's simpler than it sounds:
- 3 copies of your data. The original, plus at least two backups.
- 2 different types of storage. Not two copies sitting on the same server or the same external drive. If one storage type fails or gets compromised, the other one shouldn't be affected.
- 1 copy offsite. Somewhere physically or logically separate from your main location, whether that's a cloud backup target or a rotated drive stored elsewhere. If a fire, flood, theft, or building-wide incident takes out your office, your backup shouldn't be sitting in the same room.
A lot of "we have backups" situations turn out to be a single external hard drive plugged into the same server it's backing up. That's one copy, one location, one point of failure — not a real backup strategy.
Ransomware changed the rules
Traditional backups assumed the threat was hardware failure or human error. Ransomware specifically targets backups, modern strains actively search a network for backup files and shared drives and encrypt or delete them first, specifically so the victim has no way to recover without paying. A backup that's reachable and writable from the same network as your main systems is a backup ransomware can reach too.
This is why immutable backups. Backups that can't be altered, encrypted, or deleted for a set retention period, even by someone with admin credentials, have gone from a nice-to-have to a standard recommendation. Platforms like Veeam, Cohesity, and modern NAS systems from Synology and QNAP all support this in some form now. If your current backup solution doesn't, that's worth a conversation.
An untested backup is a hypothetical backup
The only way to know a backup actually works is to restore from it, not check that the job log says "success." A real backup plan includes periodically restoring a real file, a real folder, or ideally a full test restore of a critical system, on a schedule, not just when disaster hits. This is the step almost everyone skips, and it's the one that actually matters.
It's also worth knowing two numbers for your business, even in rough terms:
- Recovery Point Objective (RPO). How much data you can afford to lose. If backups run nightly and something fails at 4pm, you've lost a day's work. Is that acceptable, or does it need to be hourly?
- Recovery Time Objective (RTO). How long you can afford to be down while restoring. An hour is very different from three days, and your backup solution needs to be built around the answer, not the other way around.
What this looks like done right
For most small and mid-sized businesses, a solid setup means: automated backups running on a schedule you don't have to remember to trigger, at least one copy offsite or in the cloud, immutability or air-gapping so a compromised network can't reach and destroy the backup too, and a real, scheduled test restore, quarterly at minimum. None of this requires enterprise budget; it requires the right design for your actual size and risk, which is exactly the kind of right-sizing that gets skipped when backup software is bought off the shelf without anyone mapping it to what the business actually needs to survive.
Where to start
If you're not sure whether your current backup setup would actually survive a real test, that's the most useful place to start, not buying new software, just finding out honestly where the gaps are. We work with NAS and backup platforms including Veritas NetBackup, Veeam, Cohesity, Synology, and QNAP, and can review what you already have before recommending anything new.