Backup is not the same as business recovery

A backup can confirm that copies of data were created. It does not prove that the business can restore those copies, rebuild the required systems, reconnect employees and resume essential work within an acceptable time.

That distinction matters to every organization that depends on email, Microsoft 365, accounting records, customer information, websites, cloud applications or files stored on employee devices. A useful recovery plan connects protected data to people, systems, priorities and tested procedures.

Backup, sync and business recovery are different

Backup creates one or more recoverable copies of information. A well-designed backup system keeps appropriate history, protects copies from unauthorized changes and records whether scheduled jobs succeed.

Synchronization keeps files consistent across devices or locations. It supports collaboration, but a deletion, encryption event or unwanted change may synchronize too. Version history and recycle bins can help, but their coverage and retention must be understood rather than assumed to be a complete backup strategy.

Business recovery is the coordinated process of restoring technology and operations after disruption. It includes the correct data, applications, identities, devices, network access, vendor support, communication and decision-making needed to resume work safely.

Decide what must recover first

Not every system needs the same protection. Begin by identifying the activities that generate revenue, serve customers, meet legal or contractual duties, pay employees and keep operations moving. Then map the information and technology each activity depends on.

Two planning measures help translate business needs into technical requirements:

• Recovery Time Objective (RTO): the target time for restoring a service after disruption. If the business cannot operate without email for more than four hours, that expectation should influence tools, staffing and procedures.
• Recovery Point Objective (RPO): the maximum period of recent data the business is prepared to lose. An eight-hour RPO generally requires recovery points frequent enough that no more than approximately eight hours of work is at risk.

RTO and RPO are business decisions before they are technical settings. Shorter objectives usually require additional cost, automation and operational maturity. Document realistic targets for each essential service instead of applying one number to everything.

Build a practical backup and recovery strategy

1. Inventory essential data and systems

   Include servers, employee devices, Microsoft 365 or other cloud services, accounting platforms, databases, websites, configuration files, administrator records and information held by third parties. Assign an owner to each item.

2. Classify business importance

   Identify which systems must return first and how downtime or data loss would affect customers, revenue, privacy, safety and contractual commitments.

3. Use multiple protected copies

   A common starting model is 3-2-1: maintain three copies of important data, on two types of storage, with one copy offsite. Adapt the design to actual risks, and include a copy that is offline or otherwise protected from routine administrative access.

4. Encrypt backups and restrict access

   Backup information can be as sensitive as production data. Limit administrative access, use MFA where available, separate backup credentials from everyday accounts and protect encryption keys and recovery codes.

5. Keep useful retention and versions

   A single current copy may already contain corruption, accidental changes or ransomware-encrypted files. Retention should provide recovery points far enough back to reach a known-good state.

6. Monitor every scheduled job

   Assign someone to review failures, capacity, disconnected devices, expired credentials and protected-system changes. “No alert received” is not proof that every required backup completed.

7. Document the restoration process

   Record where copies are stored, who is authorized, how vendors are contacted, which systems return first and how restored data is validated. Maintain an accessible protected copy of the plan.

8. Test restores and record results

   Restore representative files and systems on a defined schedule. Record the date, scope, duration, result, issues and corrective actions so recovery readiness is based on evidence.

Design for ransomware and account compromise

Ransomware can encrypt production data, connected drives and reachable backup repositories. Attackers may also try to delete recovery copies before disrupting the business. Recovery protection therefore needs separation, not only additional storage capacity.

Use offline, immutable or logically isolated recovery copies where appropriate. Separate backup administration from ordinary user and production-administrator accounts. Require MFA, restrict deletion privileges, monitor changes and preserve several recovery points. Before restoring after a suspected compromise, contain the incident and identify a safe recovery point so infected or attacker-controlled systems are not simply rebuilt.

Cloud services still require recovery decisions

Cloud platforms provide infrastructure resilience and may include recycle bins, retention, version history or native recovery features. Those capabilities are valuable, but they do not automatically match every business requirement. Review what the subscription protects, how long information is retained, which applications and object types are covered, how bulk restoration works and what happens after an employee account is deleted.

Clarify responsibility for Microsoft 365 email, OneDrive, SharePoint, Teams, cloud applications and data created on local devices. If a separate backup product is used, confirm coverage and test a real restore rather than relying only on a product dashboard.

A simple recovery-testing schedule

A test should verify more than whether a file opens. Check completeness, permissions, application functionality, recovery duration and whether business users can perform the required work. Failed or slow tests are useful when they lead to corrective action before a real emergency.

Questions to ask a backup or IT provider

1. Exactly what is protected?

   Request coverage by system, application, location, account and data type, including exclusions.

2. What RPO and RTO can the service support?

   Separate service capabilities from contractual commitments and business expectations.

3. How are backup copies isolated and secured?

   Ask about encryption, MFA, immutable or offline copies, deletion controls and administrative logging.

4. How long are versions retained?

   Confirm daily, weekly and longer-term recovery points plus any storage or retrieval costs.

5. How often are restores tested?

   Request documented results and clarify whether testing covers complete workloads or only sample files.

6. Who leads recovery during an incident?

   Define contacts, approvals, communication, after-hours support, responsibilities and escalation paths.

Official guidance and next steps

The Canadian Centre for Cyber Security recommends regularly backing up essential business information to a secure external location, encrypting and restricting access to backups, considering offline offsite storage, documenting restoration procedures and regularly verifying that backup and restore mechanisms work as expected. Its baseline controls also place incident recovery within disaster recovery and business continuity planning.

Review the official Canadian baseline cyber security controls and the NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide. For related controls, use CommzzTech’s small-business cybersecurity checklist, Microsoft 365 security checklist and managed IT support guide.

Important: This article provides general information. Recovery requirements depend on your systems, business impact, contracts, insurance, privacy obligations and risk tolerance. Have qualified technical and legal professionals review requirements appropriate to your organization.

← Back to all resources