How good is your backup service, really?

A backup service is exactly as good as its last tested restore: if you haven’t recently checked that your data can be recovered, you don’t know how good it is. Setting up a backup and never checking it is not the right way to treat a critical element of business resilience.

The backup service is undoubtedly one of the most important components of an organization’s infrastructure. But because you don’t need backups until things go wrong, it’s all too easy for some organizations to set up the systems and forget about them, which can be a recipe for disaster. What should an organization do to make sure its backups are in good shape the moment they’re needed?

With employees working from the office, from home or on the road, there are extra considerations too: backups have to be made regularly, be complete and be quick to restore, wherever the data lives.

Backup as a Service: tell me more →

Review, review, repeat

The only way to be sure your backups are fit for purpose is to follow the process very closely. This holds wherever people work: in the office, at home or anywhere else. The basic rules of good practice don’t change.

In some organizations, the people in charge of backups may find they’re always playing catch-up.

Disaster recovery expectations never match actual IT disaster recovery capabilities.

It’s a fairly pessimistic view, but it’s the only way an IT team can be sure it gives its very best when disaster recovery is needed.

Cătălin Răducanu, Executive Director at RezolvIT, tells us from experience that, if left unchecked, problems can pile up over time. “If you have a large enough IT environment, every day there will be something that isn’t working,” he says. “In most cases the problems are minor, but they have to be checked and fixed, otherwise the most recent recovery point will be too old.”

How often should you test restoring a backup?

You should test restoring a backup at least once a quarter and, if possible, every month. Ideally, the IT team runs these data recovery checks through real restores: a file, a mailbox, a whole server, in turn. The more time passes between tests, the greater the risk for the organization.

Besides the tests, someone has to check the backup reports every day: a failed backup that goes unnoticed for a few weeks means weeks of lost work at the first incident.

The test answers two questions every company should have settled in advance:

• How old can the most recent recovery point be? If the backup runs once a night, an incident at 5 p.m. means a lost working day. For some companies that’s acceptable; for others it isn’t.
• How long can you afford to wait for the restore? A few hours or a few days make the difference between an unpleasant incident and a crisis.

Does your provider give you what you need?

The truth is that companies rely on third parties for backup services, and it’s vital that those providers do their job. For that to happen, an organization has to set the service specifications correctly. In the best examples, finding the right solution is a joint effort, in which the provider advises the organization without selling it more than it needs, and the organization understands its needs and buys what’s necessary. Both sides also need to keep the future in mind, so the direction in which the organization is growing can be taken into account.

IT services for companies: tell me more →

The key questions to ask a backup provider include:

• Can the solution scale and, if so, what’s the mechanism, how quickly can it be done and at what cost?
• How quickly are errors and support issues resolved? Is support for new applications provided quickly?
• How quickly can data be restored, including full disaster recovery? When was this last tested?
• What archiving services are offered?
• How are backups protected against ransomware, data theft and other attacks? For example, is the data encrypted end to end, so it stays protected even if it’s stolen, and are the backups properly isolated from the network, or impossible to modify or delete (immutable backup)?
• Where is the data stored, and how is GDPR complied with?
• Is data from Microsoft 365 or Google Workspace included too?

Although this isn’t an exhaustive list, and organizations’ needs can and will vary, these items should be considered essential to any backup strategy, because if any of them fails, the consequences can be disastrous for people and for the organization.

Cătălin puts it simply: “Nobody gets congratulated or rewarded when [the restore process] works, but if it goes wrong, there will certainly be consequences.” He adds: “In an ideal world, backup would happen quietly in the background; in the real world, [backups] fail quite often.”

What does a good backup look like in 2026?

A good backup in 2026 follows a few simple rules:

• The 3-2-1 rule: at least three copies of your data, on two types of media, one of them in another location. Details in the article on the 3-2-1 backup policy.
• A copy that an attack can’t touch: offline or immutable. Ransomware attackers first look for and delete the backups reachable from the network, then encrypt the data.
• Cloud data needs backup too. Microsoft 365 and Google Workspace keep deleted files only for a limited period, and a deletion or encryption synced from a computer reaches the cloud as well.
• The laptops of people working from home are included in the backup, not just the office servers.
• The restore has a written plan: what gets recovered first, who decides, and how the company keeps working in the meantime.

For companies that fall under the NIS2 Directive (in Romania, GEO 155/2024), backup management and business continuity are part of the mandatory risk management measures.

Working from home doesn’t change the basics of backup

Many companies now work in a hybrid setup: employees come to the office for collaborative projects, client meetings and presentations, and work from home the rest of the week.

Whatever the working model, companies need to keep their backup regime in mind, and organizations must be able to reliably store, access and restore the files of remote users every day.

Companies should choose backup solutions that can be managed remotely and that allow quick changes with minimal disruption.

Working with a remote workforce may have exposed some problems in backup and restore processes, but perhaps they’d been lurking for a long time, waiting to surface. Catch them early and deal with them: they’re an opportunity. If you ignore them, sooner or later they’ll cost you.

Data backup: 5 simple, easy-to-implement strategies

RezolvIT is an IT outsourcing company in Bucharest, ISO/IEC 27001 certified, used to securing and protecting its clients’ infrastructure. Whether it’s laptops, desktops, servers or mobile devices, we take care of Backup as a Service and of securing your office infrastructure. We start with a free IT audit, which also gives you the exact price.