Most backup failures have nothing to do with the backup software itself. They come from decisions made at setup: where copies live, who can touch them, and whether anyone actually checked they work. If those architectural choices are correct, the specific tool being used becomes almost irrelevant.
The 3-2-1 Rule Still Matters, But It’s Not Enough Anymore
Three copies of your data, on two different media types, with one copy offsite. That’s the 3-2-1 rule, and it’s been the standard for over a decade because it protects against the boring stuff: a dead hard drive, a fire, a stolen laptop. It still belongs in your plan.
But ransomware breaks the old assumptions. Modern strains don’t just lock one machine – they crawl the network and encrypt every drive they can reach, including mapped backup drives and connected NAS devices. A second copy sitting on a device that’s always online and always connected isn’t really a second copy anymore. It’s a bigger target.
That’s why an isolated, immutable, or air-gapped copy has become mandatory rather than optional. Immutable storage is write-once, read-many – once a backup lands there, nothing on your network, not even a compromised admin account, can modify or delete it. If you only take one thing from this article, take that.
Build The Setup In Layers, Not As One Big Job
A sound structure looks like this: automate nightly backups to a dedicated on-site device, then push a second, encrypted copy offsite – to cloud storage or an immutable repository – on its own schedule. Never rely on a second drive sitting in the same building as the first. That’s not redundancy, that’s a false sense of security.
Cloud backup works well as the offsite leg for most small and mid-sized operations because it comes with built-in versioning and geographic redundancy, so you’re not managing a second physical site yourself. Versioning matters more than people realize – it lets you roll back to a file from three days ago if this morning’s version turns out to be encrypted or corrupted, rather than just having “a backup” with no history behind it.
If you’re evaluating providers, a managed IT partner like pointertechit.com/ can help you design the right layered setup for your environment.
Define Your RPO And RTO Before You Buy Anything
Before picking a tool, put numbers on two things first. The first is the Recovery Point Objective (RPO), which determines how much data you can afford to lose. For example, if your last good backup is from 24 hours ago, do you need to re-enter a day’s worth of orders and emails? Can the business cope with losing all of today’s work? The second is the Recovery Time Objective (RTO), which establishes how long the system can be down. The difference between being down for an hour or three days is huge.
Different workloads deserve different answers. Your accounting system might require an RPO of one hour and an RTO of two hours. Archived project files from three years ago might tolerate a 24-hour RPO with no urgency at all. Write those numbers down for every major system. They tell you if you need hourly snapshots or nightly ones. They tell you if you need instant local failover or can wait on a cloud restore.
Lock Down Access The Same Way You Lock Down The Data
Encryption at rest and in transit is table stakes at this point – AES-256 is what you should be asking for, especially once a third party enters the picture anywhere along the chain. But encryption won’t save you if your backup account is sitting on the same credentials as your everyday admin logins.
Think about it: if someone gets hold of domain admin access, and that same account can also delete or overwrite your backups, you’ve basically handed them the keys to your entire recovery plan. Backups need their own credentials, their own permissions, and ideally their own authentication method entirely – kept well away from the accounts used for day-to-day admin work.
This is the kind of thing that gets overlooked until it’s too late. Plenty of organizations tick the encryption box and assume they’re covered, without ever stopping to ask who can actually touch the backups and how. A ransomware group that lands admin credentials doesn’t need to break your encryption – they just need to delete the one thing standing between you and having to pay up.
Test The Restore, Not Just The Backup
A backup that finishes successfully barely tells you anything. It lets you know that some data was transferred to another location. But it doesn’t guarantee that such a copy can be used to restore everything, onto potentially new systems, within your RTO.
Have a recovery exercise once a quarter. Select one of your systems, attempt to restore and run it in a sandbox, then take notes – how long it took, what imploded, what didn’t come back. Treat anything that hasn’t been restored and verified in the last 90 days as unverified, full stop.
An untested backup is a guess dressed up as a safety net, and guesses are expensive: the global average cost of a data breach now sits at $4.45 million (IBM). That figure includes plenty of businesses that had backups. They just hadn’t checked them.
Someone Has To Be Watching, All The Time
Even a well-designed system can fail silently. A job quietly stops running, a storage quota fills up, or an agent loses connectivity to the cloud target – and no one notices until that system is needed and it’s not there. Automated alerts via email or text, tied to a real person who takes action, can determine whether a failure is caught overnight or during a critical event three weeks later.
This is where most internal IT departments run out of resources. A small team can certainly build a solid backup architecture. But keeping that backup system monitored, updated, and restore-tested around the clock, every week of the year, is a different kind of job – one that usually needs a 24/7 network operations center behind it, which most in-house teams don’t have.
A backup system is not a setup-and-forget type of solution. It’s a set of decisions – what to back up, where to store backups, who has access, how often to test restores – and each of those decisions is easier to get right when you treat the plan as a living thing instead of a one-time checkbox.
