Two numbers that dictate everything else
How much data can you afford to lose? The interval between two backups determines how much work is lost. A daily backup means, in the worst case, a lost day of work.
How long can it take to get back up and running? The difference between starting a system directly from a backup and copying it back over the network can be the difference between an hour and two days.
Determine these two numbers for each system before comparing products. Business-critical systems and archive data require different answers, and it is expensive to treat them the same.
Immutability is what survives ransomware
An attacker who gains access to your systems will look for the backup first. Protection that can be deleted by an administrator can also be deleted by someone who has stolen the administrator's credentials.
Immutable backup means copies that cannot be changed or deleted for a set period, not even by an authorized user. This is why they survive an attack, and why they are the final layer in a functional security architecture.
Microsoft 365 needs its own backup
This is the most common misconception in the industry.
Microsoft is responsible for the availability of the service—that is, ensuring the servers are running. They are not responsible for restoring data that you have deleted yourself, that an attacker has deleted after a account takeover, or that has been lost during a faulty migration.
Recycle bins and retention periods are not backups. They are delayed deletion.
A backup that has never been tested is just a hope
Recovery testing is the step most often skipped, and the only one that actually proves your protection works.
Make it a recurring routine instead of an exercise you plan to do next quarter. Also, test the right thing: being able to retrieve a single file says nothing about whether an entire system can be restarted.
Where should the data be stored?
This question has shifted from a technical detail to a procurement requirement. GDPR, public tenders, and NIS2 have all contributed, and for many organizations, it is no longer enough for a provider to simply have servers in Europe.
By keeping storage separate from backup software, you can change one without changing the other, and move your data if prices or requirements change.
