Data Backup Best Practices for Businesses: What a Backup Plan Actually Needs

When a business loses data, the question is rarely whether there was a backup. It’s whether the backup was recent enough, complete enough and still intact after whatever caused the loss. Those three things are what this guide is about. It sits alongside our page on business continuity and disaster recovery services.

I’m Jeffrey Bowles, Partner and Director of IT Services at ACT360. Below: the practices that matter, the 3-2-1 rule, why one copy should be offline, what Microsoft 365 does and doesn’t keep for you, how often to back up and how long to keep it, how to protect the backups themselves, and how to know they’ll work.

Data backup best practices are the habits that make sure a business can get its data back after a failure, mistake or attack: multiple copies, at least one offline, regular automated backups, encryption, restricted access and tested restores.

Here’s the short version a business can check itself against:

1. Know what you have. List every place business data lives, including Microsoft 365, line-of-business applications and laptops.
2. Follow 3-2-1. Three copies, two types of storage, one off site.
3. Keep one copy offline or otherwise disconnected from your network.
4. Set recovery targets for how much data each system can lose and how fast it must be back.
5. Automate the schedule so backups don’t depend on someone remembering.
6. Encrypt backups and limit who can reach them.
7. Protect the backup console with its own admin accounts and MFA.
8. Test restores on a schedule and write down the results.
9. Review after every big change, such as a new system, a cloud move or a new office.

None of these is new. The Canadian Centre for Cyber Security’s baseline controls for small and medium organizations include backing up systems that hold essential business information, storing backups encrypted, considering offline storage at a secure off-site location, and regularly checking that backup and restore work as expected.

The 3-2-1 backup rule means keeping three copies of your data, one original and two backups, on two different types of storage, with one copy kept off site. The Canadian Centre for Cyber Security recommends it.

The wording comes from the Cyber Centre’s tips for backing up your information, which says to have three copies of your information saved on two different media types, with one copy kept off site. The point is that no single event, whether a failed drive, a burst pipe or a stolen laptop, should take out every copy at once.

For a 25-person office, that might look like this: the live data on the server or in Microsoft 365, a backup on a local backup device for fast restores, and a second backup in a separate cloud backup service or on drives rotated off site. The local copy gets you back quickly after a small mistake. The off-site copy gets you back after something bigger.

One caution: syncing isn’t a copy in the 3-2-1 sense. If a file is deleted or encrypted on one synced device, the change usually spreads to the others. A backup has to keep earlier versions you can go back to.

Because ransomware often goes after backups. If every backup is connected to your network, an attacker who gets in can encrypt or delete them along with everything else, and you’re left with nothing to restore.

The Cyber Centre’s ransomware playbook is blunt about it: many ransomware variants are designed to locate, spread to and delete system backups. It recommends having two or more backups stored offline and inaccessible from your networks and internet connection, and says offline storage offers the most protection against ransomware.

This isn’t a rare problem. Statistics Canada’s survey on the impact of cybercrime on Canadian businesses found that about 1 in 6 (16%) Canadian businesses were affected by a cyber security incident in 2023, and 13% of those affected reported ransomware. Recovery costs for businesses doubled from about $600 million in 2021 to $1.2 billion in 2023.

Offline can mean different things in practice: drives that are disconnected and stored securely, a cloud backup service that keeps copies the production network can’t change or delete, or both. What matters is that someone with access to your office network can’t reach every copy.

Not in the way most people assume. Microsoft 365 keeps deleted items for a limited time and protects its own infrastructure, but your business is still responsible for its data, and recycle bins are not a backup.

Microsoft’s shared responsibility model says that whatever service you use, you keep responsibility for your data, including data protection. The built-in safety nets are real but short:

• SharePoint and OneDrive: deleted items are kept for 93 days, per Microsoft’s recycle bin documentation. After that, they’re gone.
• Exchange Online: permanently deleted items are kept 14 days by default, adjustable to a maximum of 30, according to Microsoft’s page on deleted item retention.

That covers someone deleting a file by mistake and noticing quickly. It doesn’t cover a mistake found four months later, a departing employee who cleared out a mailbox, or an attacker who got into an admin account.

The fix is a separate backup of Microsoft 365 data. Microsoft now sells its own option, Microsoft 365 Backup, which backs up SharePoint sites, OneDrive accounts and Exchange mailboxes and is priced by the amount of data protected rather than per user. Third-party services do the same job. Whichever you use, check where the backup copy is stored and who can delete it.

Back up each system often enough that losing everything since the last backup would be survivable, and keep backups long enough to recover from problems you don’t notice right away. Those two numbers should be set per system, not once for the whole business.

Two terms help here. The recovery point objective (RPO) is, in NIST’s definition, the point in time to which data must be recovered after an outage. In plain terms: how much work can you afford to redo? The recovery time objective (RTO) is how long a system can be down before it seriously hurts the business.

The table below is an example of how a business might set these, not a standard. Your numbers should come from asking each department what an outage would cost them.

On backup types, the Cyber Centre’s backup tips describe three: a full backup copies everything and is the most expensive and time consuming; a differential copies what changed since the last full backup; an incremental copies only what changed since the last backup of any kind. Most business systems combine a periodic full backup with frequent incremental ones, all automated.

For retention, keep in mind that long-term copies are the ones that save you from slow problems. The Cyber Centre’s baseline controls suggest frequent backups, such as daily ones, may be stored online, while long-term ones, such as weekly backups, must be stored offline. How long you keep them depends on your legal and contract obligations, so ask your accountant or lawyer what applies to your records.

Treat the backup system as one of your most sensitive systems: encrypt the backups, keep the admin accounts separate from everyday accounts, require MFA, and limit who can change or delete backup jobs.

• Encrypt backups, on site and off. The Cyber Centre’s ransomware playbook recommends encrypting backups, and a lost drive or a breached storage account shouldn’t hand over readable data.
• Separate the accounts. The account that manages backups shouldn’t be the one someone uses to read email. If an everyday account is compromised, the backups stay out of reach.
• Turn on MFA for the backup console and the storage it writes to.
• Limit access to the people who need it for testing and restores, which is the approach the Cyber Centre’s baseline controls describe.
• Alert on changes, so a deleted backup job or a shortened retention period gets noticed the same day.
• Scan before you restore. The playbook advises running antivirus and anti-malware checks on a backup before restoring from it, so you don’t bring the infection back.

Only by restoring from them on a schedule and checking the result. A backup job that reports success tells you it ran. It doesn’t tell you the data inside it can be recovered.

The Cyber Centre’s playbook suggests a regular schedule to test backups, for example monthly, and testing the restore process, not just the backup job. Our guide on how often to test your backups lays out a practical cadence: monthly for critical systems, quarterly for a full restore across general systems, and a full disaster recovery test once a year. That last one is covered in our article on disaster recovery testing.

Write down every test: the date, what was restored, how long it took and whether it worked. That record is what you’ll want when an insurer, client or auditor asks how you know your backups would work.

Each backup option protects against different problems. Most businesses need a combination: a fast local copy, an off-site or cloud copy, an offline copy that ransomware can’t reach, and a separate backup of Microsoft 365.

If you’re working out how backups fit into the bigger picture of staying open through an outage, our explainer on business continuity vs disaster recovery shows where each piece sits.

We start by asking what each part of the business can live without, and for how long. That’s the Assess and Comprehend part of our ACTION approach: look at what you have and how it performs, then understand how the business actually runs. Backup frequency, retention and the offline copy are set from those answers rather than a default applied to every client.

From there we document the setup, schedule and record restore tests, and review the plan when something changes. We’re based in Barrie, and our page on business continuity and disaster recovery in Barrie covers how this works for businesses across Simcoe County.

Good backups aren’t complicated, but they are specific. Three copies, one offline, Microsoft 365 included, recovery targets set per system, the backups themselves locked down, and restore tests on the calendar. If you can tick all of those, your backups are in good shape.

If you’re not sure where your backups stand, our free IT Readiness Assessment is a 30-minute review of your backups, security and recovery plans, with a short list of what to fix first. You can also call 705-739-2281 or email [email protected].