Backup & Disaster Recovery

Backup vs disaster recovery

Backup and disaster recovery are related but distinct. Backup is the process of copying data so it can be restored if lost. Disaster recovery is the broader plan for how your business continues operating after a significant IT failure — whether that's ransomware, hardware failure, a natural disaster, or human error.

You can have backups and still not be able to recover. The backup might be corrupted, incomplete, or take so long to restore that the business can't function in the meantime.

The 3-2-1 rule

The 3-2-1 backup rule is the standard starting point: three copies of your data, on two different media types, with one copy offsite. In practice for most Canberra businesses, this means local backup (NAS or server), cloud backup, and ideally an immutable copy that ransomware can't encrypt or delete.

Immutability is increasingly important. Modern ransomware specifically targets backup systems. An immutable backup — one that can't be modified or deleted for a defined period — is your last line of defence.

Recovery time and recovery point objectives

Two metrics define your recovery capability:

• Recovery Time Objective (RTO) — how long can your business operate without IT systems? This defines how fast you need to be able to restore.
• Recovery Point Objective (RPO) — how much data can you afford to lose? This defines how frequently you need to back up.
• A business that can't operate without IT for more than four hours has a four-hour RTO. If your current backup takes 24 hours to restore, you have a problem.

Microsoft 365 is not a backup

Microsoft 365 retains deleted items for a limited period and provides some version history, but it is not a backup solution. Microsoft's shared responsibility model explicitly states that data protection is the customer's responsibility.

If a staff member accidentally deletes a SharePoint site, or ransomware encrypts your OneDrive files, Microsoft's built-in retention may not be sufficient to recover everything. A dedicated Microsoft 365 backup solution — separate from Microsoft's own retention — is the right approach.

Ransomware and your backups

Ransomware has fundamentally changed the backup conversation. Modern ransomware variants actively seek out and encrypt or delete backup repositories before triggering the main encryption payload. If your backup is accessible from the same network as your production systems, it's at risk.

Air-gapped or immutable backups — stored in a location that ransomware can't reach — are now a baseline requirement, not an optional extra. Cloud backup solutions with immutability features, or offline tape backups, provide this protection.

Testing your backups

A backup you've never tested is a backup you can't rely on. Backup testing should be a scheduled, documented activity — not something you do for the first time during an actual incident.

At minimum, test a full restore annually and a partial restore (individual files, mailboxes, or databases) quarterly. Document the results, including how long the restore took, so you know whether your RTO is achievable.