One thing up front: compliance, data loss prevention and backup are three different conversations. This article is about backup, making sure your data can be brought back, intact, when you need it.

Know what downtime would cost you

Most owners have never done the math on downtime. That number should drive every backup decision you make.

Here’s what it looks like when nobody has. A company we worked with got hit by ransomware. They had backups, but those backups lived on the same devices the attackers encrypted, so nobody could say whether a clean copy existed. Recovery became trial and error: restore, test, hope. What finally saved the most time was a database backup pulled off one of the infected systems. That was luck, not a plan.

A brand-new server had to be built. Three teams worked the problem: internal IT, the line-of-business software consultants and us. The business was down for at least four days. Multiply those hours by average salaries alone and it was a six-figure problem, before counting a single lost sale.

They had backups. What they didn’t have was a backup they could trust.

Run the numbers

Downtime cost = lost revenue + lost productivity + recovery costs

• Lost revenue: annual revenue ÷ working hours per year (about 2,080) × hours down × the share of revenue truly lost, not just delayed

• Lost productivity: people affected × their loaded hourly cost (wages plus benefits) × hours down

• Recovery costs: outside IT, software consultants, overtime, replacement hardware

For example, take a $2M company with 15 staff at $35 an hour loaded. It’s down for four business days (32 hours), loses half the revenue in that window, and spends $10,000 on recovery:

Turn that number into recovery targets

Use your number to answer two questions for each system:

• How much data can we afford to lose? This is your recovery point objective (RPO). An hour’s worth? A day’s?

• How long can we afford to be down? This is your recovery time objective (RTO).

Three tiers are enough for most small businesses:

These are business decisions, not IT settings. Your IT provider builds to them, but you set them.

Some databases can also roll back to a specific moment, say 2:14 PM instead of last night. That’s called point-in-time recovery. You may not need it, but you should know it exists when you set your targets.

Hold your backups to 3-2-1-1-0, not 3-2-1

The old rule was 3-2-1: 3 copies of your data, on 2 different types of storage, with 1 copy offsite. It’s still the foundation. It’s no longer the standard.

The standard now is 3-2-1-1-0, which adds two requirements:

• 1 immutable or offline copy. At least one copy that cannot be changed or deleted, not by an attacker and not by your own admins. This is a requirement, not an upgrade.

• 0 errors on restore. The backup has been restored in a test and proven to work.

Why 3-2-1 stopped being enough

Attackers know that if your backups survive, you don’t have to pay them. So they go after the backups first.

• In Sophos’s research, 94% of ransomware victims said attackers tried to compromise their backups; 57% of those attempts succeeded.

• Victims whose backups were compromised were almost twice as likely to pay the ransom (67% vs. 36%).

• Their recovery costs were about eight times higher: $3 million versus $375,000.

Attackers also move faster than they used to. Work that was once done by hand is now automated, and AI has shrunk the time between an intruder getting in and spreading through the network. CrowdStrike’s 2026 Global Threat Report found that time averaged 29 minutes in 2025; the fastest was 27 seconds. You can’t count on catching an intruder before they reach your backups. The copy they can’t touch is what’s left when everything else is compromised.

Make sure “immutable” is real

Many products claim to be immutable. Here’s how we hold the line:

• Separate credentials. The storage location, the backup software and the people using them each get their own credentials and API keys. Your everyday admin login should never be able to delete a backup. In our higher security tiers, backup access is also watched by a security monitoring system (SIEM).

• Offline plus immutable. We require at least one copy that’s completely offline, plus immutable copies.

• Proof in writing. Read the vendor’s technical documentation and your service agreement, and ask:

  • Can anyone, including our admins or your support staff, delete a backup or shorten its retention before it expires?

  • Is immutability enforced by the storage itself, or by a setting someone could turn off?

  • Is backup access protected by separate credentials and multi-factor authentication?

  • Where is that commitment written in our agreement?

Don’t count sync, replication or archive as a backup

These tools all copy data, so they get mistaken for backup. Each one solves a different problem and fails in its own way.

Sync and replication keep you running. Backup lets you rewind. Archive lets you prove. You need the right mix; none of them replaces backup.

Keep backups as long as your risk and your regulations require

Two things set your retention: how much operational risk your business can tolerate, and what your compliance obligations require. If you’re regulated, compliance also shapes which backup methods you can use and where your data can be stored:

• HIPAA (medical): the Security Rule’s contingency plan standard requires a data backup plan, a disaster recovery plan and an emergency-mode operation plan, and calls for periodic testing and revision of those plans.

• SOC 2: the Availability criteria cover backup and recovery, including testing recovery procedures.

• CJIS (county and law enforcement data): adds requirements around encryption, physical and personnel security, and control over where the data is stored and who can reach it.

Back up everywhere your data lives

“We back up the server nightly” used to cover most of a business. Today your data is spread across places like these:

• An on-site file server or NAS

• Microsoft 365 or Google Workspace (email, SharePoint, OneDrive, Drive)

• An accounting platform like QuickBooks Online

• A line-of-business application (practice management, ERP, CRM), hosted or on-site

• Industry or vendor portals

• Laptops and phones

Every one of those needs a backup and a restore plan.

Databases and line-of-business software

You can’t just copy a database’s files and call it backed up. A good database backup lines up three things: the database technology, your vendor’s support agreement, and how the application actually runs day to day. You don’t want a backup running while your ERP is doing its daily balancing, for example. You can end up with a copy that doesn’t agree with itself.

Back up the whole working system, not just the data: the operating system, licenses, third-party dependencies, networking and configuration. Data restored onto a system you can’t rebuild doesn’t get you running.

And have your own path to your data. Confirm backup responsibilities with your software vendor, but don’t stop there. If you and the vendor disagree, or support disappears, your business and your customers still need a way back. We align with vendors and industry best practices; we also train owners to run a backup that’s independent of everything we automate.

Cloud apps

Cloud providers keep the service running. Getting your data back the way you need it is still your job.

Microsoft SharePoint is a good example. Say someone deletes a critical list or document library:

• Recycle bin: deleted items are kept for 93 days, a window you can’t change, and they can be purged sooner if the bin fills up or an admin empties it.

• Library rollback: you can roll a whole document library back up to 30 days, but it’s all-or-nothing, so everyone’s good changes get undone too.

• Microsoft Support: Microsoft keeps backups for 14 days after deletion, but you have to open a support request, you can’t ask for a single file or folder, and it can take days.

• Microsoft 365 Backup: a separate pay-as-you-go product at $0.15/GB per month. Since May 2026 it can restore individual SharePoint and OneDrive files and folders, but only to a new location, not back in place.

The same applies to every cloud tool you use. Evaluate each one on three things: who owns the data, how it’s backed up, and what the service agreement actually promises.

Laptops and phones

Every device should have at least file-and-folder backup. It doesn’t cover every type of data, but it’s affordable and protects everyday files; that’s why it’s included in every Gawa plan.

If a laptop or phone holds critical business information, plan for image-based backups so you can restore the whole device, not just its files. Getting this right comes down to scoping: knowing which devices hold what.

The keys to the kingdom

No file backup helps if you lose control of your admin accounts.

• Keep two or three admin accounts, one of them a break-glass account used only in emergencies.

• Store the break-glass credentials two ways: in a password manager and on a physical device, like a flash drive or security key, locked in a safe.

Your recovery documentation needs the same care. Keep a physical hard copy in a secure place on site, plus a current version you can reach when your network is down. For our clients, that’s Gawa’s secure documentation platform. Most important, walk through the likely data-loss scenarios ahead of time, so everyone knows the general path to restore.

A backup that isn’t tested isn’t a backup

The only way to know a backup works is to restore it. Here’s what testing catches.

During a routine restore test, we found a backup that had been reporting success for months. But the setting that makes a backup application-consistent had never been turned on, so the database inside the full system image wouldn’t load at all. On a real recovery day, that would have been a disaster. We fixed the setting, re-ran the backup and tested again. Backups ran faster, and services restored reliably.

Test monthly, by restoring

Reviewing backup logs is not enough. For managed clients, we test every month, using whatever restore method proves your business processes are protected. Testing also tells you whether a backup is clean. If you’re ever hit, knowing the type of attack tells you which footholds to look for in your backups, and you can only do that with a full view of your network and your business.

Get a one-line answer, not a report

You shouldn’t have to dig through a backup report to know you’re covered. We review results with the owner or office manager as a one-line status. The full reports are there if you want them; we just don’t fill your inbox with them.

Your test results are your insurance proof

Cyber insurance underwriting is moving from checkbox questionnaires to evidence. For backups, carriers increasingly ask for backup job reports, proof of immutable or offsite copies, and restore test results tied to your recovery targets. Strong, documented controls can help you qualify for better coverage and premiums.

The bigger risk comes at claim time. In Travelers v. International Control Services (2022), the company’s application said it required multi-factor authentication across its systems. It actually had it only on the firewall, and the attack came in through an unprotected server. Travelers moved to rescind the $1 million policy; the two sides agreed to void it. Some industry analysts put cyber claim denials as high as 40%, often over controls that were claimed but not actually in place.

Insurance is a safety net, not a recovery plan. Payouts take time and depend on proof. Can your business afford to wait for the check? Monthly restore tests are exactly the proof you’ll need.

Your vendors are part of your backup plan

Any vendor that creates or stores business-critical data is part of your backup plan, whether you planned it that way or not. The question that matters most is simple: how do I get my data if this company doesn’t exist tomorrow? Products get acquired, merged and discontinued all the time, even ones you’re happy with.

Map, check and settle ownership

We vet this during onboarding:

1. Map where business-critical information is created and stored.

2. Check what backup options exist for each system. For some SaaS products, there may be none.

3. Settle ownership. Who owns the data, and on what terms can you get it back?

Before you sign with a new vendor, know your export format, how often you can export, what it costs, and how long the vendor keeps your data after you cancel. Those answers also decide how easily you can switch products later.

Review them at every renewal, and every year

Review critical vendors at every contract renewal and at least once a year. For compliance clients, we map every critical business process that depends on a third party, since those vendors need security monitoring too.

Your IT provider is a vendor too

Ask what you’d walk away with if you left. At Gawa, we handle offboarding as seriously as onboarding. With 30 or 60 days’ notice, you get all the documentation on your business, and we coordinate backups with your new provider, or with you directly, so your data stays protected through the changeover.

Where to start

You don’t need to fix everything this quarter. Start with a conversation. Sit down with your team and talk through your business processes: what systems each one runs on, and how that data gets backed up. It costs nothing, and it’s usually eye-opening.

Then ask your IT provider these five questions:

1. Do we hold ourselves to the 3-2-1-1-0 standard?

2. Does any part of our backup depend on one person being in the office? If Barry runs the backups on his flash drives and Barry is on vacation, your backups aren’t happening.

3. What schedule do our backups run on?

4. When were they last tested, by actually restoring something?

5. If one of our software vendors disappeared tomorrow, how would we get our data back?

If any answer is “I’m not sure,” that’s your starting point.

It’s where we start, too. Gawa’s approach is to understand your business processes and your people first, because that’s how we make sure the backups cover what’s actually critical. It’s how we find the Excel “database” on the warehouse floor holding 20 years of shipping history, built by a supply chain manager two decades ago, and make sure it’s properly protected.

Not sure where you stand? Book a free business workshop or a backup review with Gawa.