Data backup in the company: what solution is really safe?

Most entrepreneurs believe that their data is safe because "IT guy set something up" either "files are in the cloud". This sense of security often only lasts until the first major incident. In practice, the moment of the attempt to recover data verifies the quality of the solutions used, often in a painful way.

From the perspective of many years of work with IT infrastructure, we see a recurring pattern: companies invest in hardware and software, but neglect procedures. Having backup is not just a matter of technology. It's an insurance strategy for business continuity.. If a company loses access to its customer database, order history or accounting, financial losses result not from the failure itself, but from the time needed to restore the systems to operation.

This article aims to explain how to design data backup in the companyso that it actually works in a crisis situation, instead of becoming a source of frustration.

What is data backup in the company?

In the simplest terms, backup (backup) is the process of creating and storing additional copies of data in a location that is physically or logically separated from the source. The key here is the word "process". Backup is not a one-time copy of a folder "Documents" to a flash drive. It is a controlled cycle of creating, storing and testing copies, designed to enable data recovery within the specified scope and time.

You should clearly distinguish between backup and file synchronisation (such as Dropbox, OneDrive or Google Drive). Synchronisation is used to ensure access to the latest version of a file on multiple devices. If an employee accidentally overwrites or deletes an important report with incorrect data, sync will immediately propagate the error to all other devices. A real backup allows you to restore the version of the file before the error.

A well-designed backup system in SMEs should operate in the background, without user intervention, and provide the so-called versioning, i.e. access to the history of changes to files from recent days, weeks and even months.

Why do many companies lose data despite "having a backup"?

Paradoxically, many companies that experienced data loss had backup systems. So why did they fail at a crucial moment? In IT environments of companies employing 5 to 50 employees, we most often encounter the following causes of failure:

• No playback tests. This is the cardinal sin of most organisations. The system reports that the copy has been made ("Success"), but no one ever checked whether anything could be read from this file. It often turns out that the backup file is damaged or empty only after a failure.
• Backup to the same device. Copying data from the C: partition to the D: partition of the same disk only protects against accidental file deletion. In the event of a disk failure, overvoltage or laptop theft, we lose both the original and the copy.
• Backup encryption by ransomware. Modern malware first looks for backup servers in the local network, encrypts them, and only then attacks employee computers. If the backup is visible on the network as an ordinary network drive without appropriate security, it is as vulnerable as any other workstation.
• Playback time too long (RTO). Having a backup on a cheap, slow cloud can mean it takes a week to download 2 terabytes of data. For many companies, a week of downtime is an unacceptable loss, even though technically so "data is safe".

What data in your company really requires backup?

Not all data has the same critical value for the functioning of the enterprise. When implementing a security policy, resources should be categorized. This allows you to optimise costs and focus on what is most important.

Priorities include:

1. Databases of ERP/CRM and accounting systems. This is the heart of the company. Their loss paralyses sales, warehouses and settlements. The copy should be made frequently (even hourly).
2. User files (Desktop, Documents). In small companies, this is often where contracts, offers and current correspondence lie.
3. Email. Many business arrangements only exist in email inboxes. The loss of correspondence history often means the loss of evidence of a transaction or acceptance of terms.
4. Server and network device configurations. Often overlooked, but manually re-creating them takes IT staff many hours while the business is down.

Less important are temporary files, workstation operating systems (which can be reinstalled) or employees' private files, which often unnecessarily burden the backup space.

What are the types of backups used in companies?

There are many data security methods on the market. In the Polish SME environment, four approaches are most often used, each of which has its advantages and disadvantages:

• Local backup (NAS/Server). Data is copied to a dedicated device in the office.
  • Advantage: Very fast data recovery (high speed local network).
  • Disadvantage: Risk of data loss in the event of fire, office flooding, equipment theft or electrical surge.
• Cloud Backup. Data is sent to an external provider's servers.
  • Advantage: Full immunity to failures in the office (fire, theft). Maintenance-free.
  • Disadvantage: Dependence on the speed of the Internet connection. Longer recovery times for large data volumes.
• Hybrid backup. Combination of both above methods. The data first goes to the local server (quick access)and then replicated to the cloud.
  • Advantage: Combines local playback speed with cloud security. This is currently the standard in professional IT services.
• Offline Backup (Air Gap). Copy to media physically disconnected from the network.
  • Advantage: Physically disconnected media reduces the risk of a copy being altered by an attacker with network-only access, but can still be subject to failure, theft, destruction, or an error during rotation.
  • Disadvantage: Requires manual discipline (someone has to remember to connect and replace drives).

What are the characteristics of a truly secure backup?

To data backup in the company could be considered safe, it must meet rigorous standards. In the IT industry we use "3-2-1 Rule, which is the gold standard for security policy design.

It says that you must have:

• 3 data instances (one original + two copies),
• saved to 2 various media (e.g. server disk and cloud),
• of which 1 the copy is located in a different physical location (offsite).

A truly safe solution also features:

• Automation. The human factor is the weakest link. The system must operate automatically, without the need forclicking” by an employee.
• Encryption. Data transferred outside the company (e.g. to the cloud or on a portable drive) must be encrypted with a key that only the company owner has. Even if the media falls into the wrong hands, the data will remain unreadable.
• Immutability. Modern backup systems offer the function of blocking the deletion/modification of files for a specified period of time. This means that even if a hacker gains access to the administrator account, he will not be able to delete previously made copies.
• Monitoring. The system must actively report errors. Silence in the system logs often means that the service stopped working a month ago.

Playback Test: The only proof that backup exists

Backup has one feature that distinguishes it from all other systems in your company: you find out that it's not working, exactly when you need it. A green status in the console means that the task has been completed, not that the data can be restored.

The reasons why a properly made copy turns out to be useless are prosaic. The wrong directory was copied. The database was being written and the copy is inconsistent. The archive is encrypted and the password is with the person who passed away. The restore works, but it takes three days because no one calculated how long it would take to download two terabytes over this connection.

The playback test is the only way to find out in advance. It doesn't have to be complicated:

1. Select what you're playing. Not the entire environment. One system that really hurts when it's not there.
2. Play to test location, not for production. Never practice on a live system.
3. Measure your time. From the decision to the point at which the data is usable. This is your actual RTO, usually longer than expected.
4. Check the content, not the fact of play. Open file. Log in to the database. See if the last day's data is there. This is verified by the Ombudsman.
5. Save the result and date. A test without notes is no different from a test that didn't exist.

The frequency depends on how often the environment changes. Once a quarter is a reasonable minimum for most small businesses. After any major change in infrastructure: mandatory.

If the backup is handled by an external company, you have the right to ask about the result of the last test and the date it was performed. The lack of an answer to this question is itself an answer.

Cloud backup (Microsoft 365, Google Workspace)

Modern companies are massively migrating to cloud solutions such as Microsoft 365 (formerly Office 365) or Google Workspace. There is a misconception that because data is with a technology giant, it is completely safe.

It is necessary to understand the so-called Shared Responsibility Model. Vendors such as Microsoft and Google are responsible for infrastructure availability (i.e. for the servers to work, electricity to be supplied and disks to be functional). Jednak za data is answered by the customer.

Built-in recycle bin, version history, and retention mechanisms vary between services, plans, and configurations. They can help with accidental deletions, but are not a substitute for a recovery strategy tailored to the required retention period and threat scenarios. The extent of recovery should be confirmed with current documentation and tested.

RPO and RTO: two numbers starting with each backup decision

Before you compare products, answer two questions. They sound technical, but they are actually business-like.

RPO: How much data can you lose? If you back up once a day at 2:00 a.m. and the failure occurs at 4:00 p.m., you've lost fourteen hours of work. Everything the team has done since the morning must be recreated from memory and papers. The question is: can your company handle it? The answer for an accounting office in April is different than for the same company in August.

RTO: How long can you not work? It's a time from failure to return to work. It's not the time to copy files, it's the time until people do their job again. The restoration of the server from the copy can take longer than its first installation, especially if no one has practiced it before.

	RPO	RTO
Question	how much data will I lose?	how long will I be out of action?
Decreases by	more frequent copies	faster playback, ready-made equipment, practiced procedure
Reduction cost	increases with frequency	grows fast, it is the most expensive part

Both numbers are determined by the business, not the IT specialist. It is the role of the IT team to tell you how much it costs to deliver them, and to honestly warn you when the wait is unrealistic given your budget.

How to choose backup for the size of the company?

The solution should be adequate to the scale of operations and acceptable risk.

• Micro companies (5-10 people). Here, a solid NAS server with disk mirroring (RAID) and an automated copy of the most important folders to a safe cloud are often enough. It is crucial not to rely solely on USB drives connected to laptops.
• Small companies (10-30 people). The central server or domain controller usually appears in this segment. A hybrid solution is required that secures entire system images (this allows you to quickly restart the server after a failure) and dedicated email backup.
• Medium-sized companies (30-50 people). At this scale, a failure means inaction of several dozen people, which generates huge costs. It is necessary to implement Disaster Recovery procedures (emergency recovery) with specific system recovery time. It is worth considering replicating key virtual machines to an external Data Centre.

The most common errors in corporate backups

During security audits in Polish companies, we most often encounter the following negligences that disqualify the security measures in place:

1. No password documentation. It happens that only one employee who no longer works in the company knew the backup encryption password. The copy is useless.
2. Save on disk space. This results in a too short retention period. The company only has a backup from the last 3 days, and it needs to recover a file from a week ago when the error occurred.
3. External drives permanently connected. The USB disk used for backup is permanently connected to the server. In case of overvoltage or encryption attack, the server dies.
4. No personal liability. Everyone knows that "backup is in progress", but no one is assigned to check the reports of this process.

Summary: How to approach backup reasonably

Data backup in the company is not a purely IT issue. It's a business decision. The owner of the company does not need to know how to configure the disk matrix, but should know how much time his company can survive without access to the systems and how much data it can lose without going bankrupt.

A good solution is tailored to your risk and budget, and its effectiveness is proven by regular recovery testing. Technology is only part of the process; accountability, monitoring, documentation, and a procedure for responding to a failed copy are also needed.

Will your current backup system work?

If, while reading this text, you are wondering when the last time a trial data recovery was carried out in your company or whether your copy in the cloud is resistant to employee errors, it is natural to have doubts. Many companies realize the effectiveness of their security only after a failure. It is worth verifying these procedures in calm conditions before they become necessary.

W NexaIT we will gladly examine your situation during free IT review And we'll give you a clue where to start.