| A data backup strategy defines what your business protects, how much recent work it can afford to lose, and how quickly systems need to be usable again. It guides the schedule, storage, retention, security and restore testing. New Zealand’s National Cyber Security Centre states the shape as 3-2-1-1: three copies of the data, kept on two different formats, with one stored offsite and one offline. |
The scenario that follows is illustrative. A Timaru freight operator ran nightly backups for four years and never restored from them once. The job reported success every morning and the report went to an inbox nobody opened.
When a server failed on a Tuesday in March the restore ran for nine hours and returned the file share without any of the databases. The data backup job had been pointed at the wrong volume since a disk was swapped in 2023. Nobody had checked it since.
The reports had been green throughout. A backup that runs is not a data backup strategy. The difference only shows on the day somebody needs it.
That firm was trading again in four days, rebuilt from paper dockets and a supplier’s copy of the invoices. Four days of a 22 person operation running on manual process is the number to set against the cost of testing a restore.
Work out your own version by answering two questions about your worst system: how much work would you lose, and how long would you be down.
Owners can usually answer the first and not the second. Everything below is about turning both into figures somebody has checked.
How Do You Know If Your Backups Work?
You do not, until somebody restores something and checks it opens. A common pattern is that the software reports success, somebody glances at the email, and the first genuine restore attempt happens during the incident the backups were bought for.
Nobody involved is being careless. Backup software reports on whether the job finished, and while many products also verify their recovery points automatically, that is not the same as confirming the contents are the files you would ask for. A data backup job pointed at an empty folder can report success every night for a year.
There is a second failure that hides just as well. A restore that technically works but takes eleven hours is a failure if the business needed the system back in two, and nothing in the nightly report tells you which one you have.
A data backup strategy exists to close both gaps. Somebody has to own the question of whether the copies come back and how fast. In most firms nobody has been handed it.
The NCSC treats testing as part of the control itself. Its guidance on how to implement and test backups asks for a single file restore at least once a quarter and a full restoration at least once a year. Its key takeaways go further, recommending a single file restore often and a full system restoration every couple of months, so set the interval from how critical each system is and re-test after material changes.
Test the scenarios you would actually meet, not the one the software demonstrates. A file restore after somebody deletes the wrong thing, an application rollback after a bad upgrade, and a database restore after a server failure are three different tests of the same data backup, and an application that depends on its database has to be tested with it.
Write down who ran the test and what came back. A dated line saying the June restore returned the job system in 40 minutes against a two hour objective tells you more than any description of the software, and it is the record you reach for when somebody asks. What a particular insurer or auditor wants to see is a separate question to put to them.
This post covers the shape of the backups themselves. Writing the decisions down and keeping them current belongs to the backup and recovery plan. Keeping that document current is a separate job from deciding what the backups themselves are supposed to do.
What Is the 3-2-1-1 Backup Rule?
Three copies of your data, kept on two different formats, with one stored offsite and one offline. The NCSC publishes the data backup model in that form, and the last digit is the one small businesses are missing.
Count the copies carefully. Three commonly means the live data plus two data backups rather than three backups on top of the original, and the offsite copy can also be the offline one. The last digit describes a protection requirement rather than automatically adding another copy.
The illustration shows one possible design carrying an additional copy: live data, an onsite backup, an offsite backup and an offline one. A three-copy arrangement where the offsite copy is also the offline copy meets the same rule.
The older 3-2-1 version stopped at offsite, which made sense when the threat was fire, flood and theft. An offsite copy that stays connected to the network is still reachable by anything that reaches the network.
Is an immutable backup the same as an offline one?
Offline means disconnected from the network while stored: a drive unplugged between runs, or tape in a cabinet. Immutable is a different control, one that prevents protected data from being changed or deleted for a defined period, and immutable cloud storage stays online while doing it. They belong on separate lines rather than one.
Both answer the same data backup question, which is whether a compromised administrator account could destroy that copy in an afternoon. For an immutable copy, check which accounts can change the protection, when it expires, and whether recovery still works if the main environment is compromised. Denying deletion to the backup account alone is weaker than retention enforced against more privileged accounts.
Two formats matter for a duller reason. A firmware fault or a format problem can take out copies sitting on the same kind of device together, and a second format reduces that shared risk. Cloud object storage and a local disk are not automatically two different physical media types, so check what each copy actually sits on.
You also have to assume one of those copies goes missing. A backup is a second full copy of everything the business holds, so it needs protecting at rest, and the NCSC points at the NIST recommendation of the Advanced Encryption Standard with 256-bit keys.
Encryption reduces what a lost drive exposes without settling on its own whether a breach is notifiable. That assessment turns on the likely harm and on whether the information and the keys both stayed protected. Keep the keys recoverable somewhere separate as well, because an encrypted copy whose only key sat on the failed system is not a usable data backup.
Counting your own copies is a five minute exercise, and it is the fastest way to tell whether you have a data backup strategy or a habit. A common result is two copies, both on disk, both in the same building, and both mounted to the same server that would be encrypted first.
Count carefully if you use OneDrive or Dropbox. A folder that replicates to either is one copy in two places, so a deletion or an unwanted change spreads rather than being contained.
They are not empty-handed either. OneDrive keeps deleted items in a recycle bin, ninety-three days for work or school accounts by default, and holds version history so an earlier copy of a file can be restored. Check the coverage, the retention and the limits against what you would actually need, particularly when many files change at once. A separate data backup adds recovery points and separation from the live service, which is the part sync cannot provide.
When a data backup fails a small business, it is often because one of these four numbers reads zero. None of the four is a software problem, and no product decides any of them for you.
What Should a Data Backup Strategy Include?
Five settings: frequency, type, retention, media and location, as the NCSC lists them. Each is a business decision before it is a technical default, and the values the software installed with were not chosen for your business.
Frequency is how often the job runs. Type is how much moves each time: a full copy, an incremental covering what changed since the last run of any kind, or a differential covering what changed since the last full copy. Which of the three are available depends on the platform.
Retention is how long a copy is kept before it is overwritten. Media is what the copy is written to. Location is where that media lives, and whether one earthquake or one burst pipe would reach the original and the copy together.
| Setting | What it decides | Decision to make |
|---|---|---|
| Frequency | How much work a failure can cost you | How much recent work each system can afford to lose |
| Type | How long each run takes and how much it stores | Which of full, incremental or differential the platform supports, and what each costs in run time and storage |
| Retention | How far back you can reach, and the storage bill | How far back recovery must reach, and which records need separate long-term preservation |
| Media | What the copy survives | What each copy has to survive, and whether the formats are genuinely different |
| Location | Whether one event reaches both copies | Whether one event could reach the original and the copy together |
What has to be listed before you set them?
Before any of the five can be set, somebody has to list what the business actually holds. Customer records, financials, the job management system, the shared drive, the mailboxes, the configuration of the phone system. A data backup strategy built from an inventory covers all of it, and one built from a default install covers whatever was on the server that day.
Give each of those a named owner. The person who would have to recreate the data can say how much of it matters, and the technical settings exist to serve that answer. Nobody in IT can supply it for them.
One decision has no software setting attached, so it gets skipped. Backup media wants a locked cabinet away from water and heat, with access limited to the people who run the function. It is the standard you would already apply to a filing cabinet of personnel records.
The work in a small business is deciding these five once, recording what was decided, and checking twice a year that the running systems still match. Systems get added, and a data backup strategy that was accurate in March covers a server nobody had bought in August.
What Are RPO and RTO in a Data Backup Strategy?
RPO is the recovery point objective and RTO is the recovery time objective, and between them they decide almost everything else. The recovery point objective is how much work you are prepared to lose, measured in time, and it sets how often the data backup runs. The recovery time objective is how long you can be down, and it sets where the copies live and what they are written to.
The NCSC frames both as objectives the data owner sets and the IT team advises on, with a common default recovery point objective of one day.
Both are data backup targets rather than measurements. Running a job hourly does not guarantee an hourly recovery point, because a failed run, missing data or a delay widens the loss window, so compare the objective against what the last tested restore actually delivered. Recovery time also has to include replacement capacity, the dependencies a system needs, getting people access again and the business accepting it back, not just the restore itself.
A day of lost work is an irritation for a document library and a serious problem for a sales ledger. Set the numbers per system, because one figure for the whole business comes out either too expensive for the low value systems or too weak for the high value ones.
Both objectives cost money as they tighten. A copy in cloud storage is cheap to hold and can be slow to pull back down to your own site, though recovering the service in the cloud instead is sometimes faster than a local rebuild, so compare the actual recovery paths rather than assuming local is quicker. Businesses with a short objective on one system often end up holding two copies for that system and only the cheap copy for everything else.
The numbers also settle arguments that otherwise go in circles. When somebody asks whether the data backup spend is too high, the honest answer is a comparison between what the current setup delivers and what the business said it needed. Without the two numbers written down there is nothing to compare it against, and the argument stays a matter of opinion.
Where the tested recovery time cannot meet the objective, the conversation moves from data backup to standby systems, and the difference between backup and BCDR covers that ground. Choose the method from the objective and from what has actually been proven, rather than from a fixed number of hours.
Write both numbers next to each system. A data backup strategy without them is only a preference, and there is no way to tell whether the current setup meets it.
How Often Should a Small Business Back Up Its Data?
At least daily where the process is not automated, which is the floor business.govt.nz sets for New Zealand small businesses. Automate it and the question stops depending on somebody remembering.
Systems where a day of lost work would mean ringing customers to ask what they ordered need something shorter than daily. Continuous or hourly protection on a sales system and a nightly run on everything else is a common and affordable split.
Ask what each cloud provider actually offers. Service availability and recovery of your content after a deletion are different commitments, and the recovery features vary by product and by plan. Check the coverage, the retention and the limits against what you would need, and confirm that any export has a usable restore or reimport path before relying on it.
Check Microsoft 365 first. The retention settings inside it are not the same thing as a data backup, and the gap that leaves is what Microsoft will not restore.
What about the systems that are not on your server?
The same question applies to every other system the business signs up to. Accounting platforms, job management tools and payroll all hold data the business would have to recreate by hand. Very few of them are covered by whatever runs on the office server at night, and the ones that are not have to be exported or backed up separately.
There is a ceiling on how often you can run this. Large jobs scheduled close together can overlap, where a second run starts before the first has finished. Look at the scheduling, the volume and the available capacity before relaxing the objective, because more bandwidth does help when bandwidth is the constraint.
Put the data backup schedule where somebody will see it break. An alert on a failed job catches in a morning what a green report would hide for a year, and a shared mailbox or ticket queue works as well as a named person provided somebody owns it, somebody covers them and it escalates when nobody responds. Watch for missed runs and ageing recovery points too, since a failure alert cannot tell you a job has been copying the wrong volume.
How Long Should You Keep Backups?
Long enough to satisfy the rules that apply to you and no longer. Set data backup retention around the recovery points each system needs, then handle record keeping separately, because the two pull against each other.
Inland Revenue requires business records to be kept for at least seven years. Employment records, contracts and financial statements carry their own periods. That obligation is about the records themselves rather than the number of data backup sets, and a run of annual restore points does not establish that every required record was captured and remains readable, because a record created and deleted between two snapshots appears in neither.
The ladder above is an example of one retention design. The number of annual copies it shows does not by itself establish compliance with any record-keeping period.
Pulling the other way, information privacy principle 9 of the Privacy Act 2020 says an agency must not keep personal information for longer than is required for the purposes for which it may lawfully be used. A backup set with no retention limit becomes the place old personal information lives on indefinitely.
A tiered scheme suits many systems: daily copies for a month, monthly for a year, and longer-term copies where recovery genuinely needs to reach that far. It is an example rather than a requirement for every file, and records that must survive for years are better preserved deliberately than left to a backup rotation.
What happens when somebody asks you to delete their data?
This becomes real the first time a customer asks you to delete their information. Establish first what can be deleted and what has to be retained, then explain how the remaining copies expire, whether any legal hold applies, and what happens if an older backup is restored later. Avoid promising immediate removal from every system, or a single expiry date, before checking the actual arrangements.
It also decides your storage bill, and few businesses move it off whatever the software installed. Read it before the invoice makes you.
Why Do Ransomware Attackers Destroy Backups First?
Because attackers target backups to make recovery harder. The NCSC’s ransomware lifecycle puts destroying backups in the same phase as encrypting the data, after the attacker has already reached backup servers and administrator credentials. Being able to restore is a strong position, and it does not undo stolen information or remove every source of extortion pressure.
That is the whole argument for the offline copy. An attacker holding domain administrator rights can reach every connected copy in the environment, and the NCSC calls offline or disconnected backups critical to recovery for exactly that reason.
It also changes what counts as a good data backup strategy. Restore speed used to be the thing to design for, and the first question now is whether a compromised account could delete the copy at all.
This comes down to which accounts can reach the backup. Where the backup system signs in with the same domain administrator account used to run the network, one stolen password reaches the servers and the data backup together. Separate backup administration from everyday network administration, restrict destructive actions, and protect administrator access with multi-factor authentication where the platform supports it.
Human logins, automated jobs and recovery access all need treating differently, because routine background jobs run under service identities rather than prompting anybody for a code. The question to test is whether compromised production credentials could alter the backup settings, delete recovery points, or reach the keys needed to restore them.
The same blind spot shows up across the wider set of assumptions businesses make about ransomware. Backups matter most once an attacker is already inside, and they sit alongside detection, containment and removing the attacker rather than replacing any of them.
Restoring is not the end of the response either. Deal with how the compromise happened before returning systems to use, and check that the recovery point you restore from predates the intrusion and that the destination is safe to restore into.
Set alerts and read them. A failed job, a change to a data backup configuration and a sign-in to the backup server should each raise one, and each is a trigger to investigate rather than proof of an incident. A routine authorised login, an operational job failure and an unexpected destructive change are three different things.
When Did You Last Restore Something You Needed?
If nobody can name a date, the backups are unproven rather than working. Getting to a tested data backup starts with decisions and a recurring diary entry, and what it costs depends on what is already in place.
What drives the cost of a data backup strategy: how many systems and cloud services are protected, the data volume and how fast it changes, the retention required, whether immutable or offline storage is needed, how much recovery capacity you want available, licensing, monitoring and the testing itself.
Exodesk has operated since 1989, with offices in Christchurch and Dunedin serving businesses across New Zealand. Our cloud and infrastructure team reviews what a business is actually copying, sets the two recovery numbers with the people who own the data, and puts a restore test on a schedule that somebody signs.
The work is unglamorous. It is finding the volume nobody repointed after a disk swap. Then proving on an ordinary Wednesday that the copy comes back.
Not sure your backups cover the systems your business relies on? Talk to Exodesk about backup coverage, recovery objectives and restore testing, and we can tell you what the current setup supports and where it needs changing. For a broader review of your IT, visit our IT assessment page.
Frequently Asked Questions
Is a data backup strategy the same as backup software?
No. The software runs the jobs, and the strategy is the set of decisions covering what is copied, how often, where the copies are held, how long they are kept and how the restore is verified. Two businesses running the same product can have a sound strategy and a useless one.
Is the 3-2-1 backup rule still enough?
No, and New Zealand’s National Cyber Security Centre now publishes a 3-2-1-1 model in its place. The extra digit calls for a copy held offline, disconnected from the network altogether. The original rule assumed the danger was fire, flood or theft, where getting a copy off the premises was sufficient. Ransomware changed that, because an attacker working inside your network reaches every copy the network can reach.
Is an immutable backup the same as an offline backup?
No. Offline describes a copy disconnected from the network while it is stored. Immutable describes data protected against being changed or deleted for a defined period, and cloud storage can be immutable while remaining online. Check the protection settings, when they expire, and which accounts are able to change them, because denying deletion to the backup account alone is weaker than retention enforced against more privileged accounts.
What does RPO mean in backup?
Recovery point objective is the target maximum amount of recent work the business can afford to lose, expressed as time. An RPO of 24 hours means accepting the loss of up to a day of changes, and it sets your data backup frequency. The NCSC notes one day as a common default and a much shorter figure for systems like online sales. It is a target rather than a measurement: a failed run or missing data widens the actual loss window, so compare it against what the last tested restore delivered.
What is a recovery time objective?
Recovery time objective is the target maximum time to restore an agreed business service to a usable state. It has to cover replacement capacity, the dependencies the system needs, restoring access and the business accepting it back, not only the file copy. It influences where the copies are stored and on what, though the comparison is between actual recovery paths: pulling several terabytes down to your own site is slow, while recovering the service in the cloud can be faster than a local rebuild.
Is a daily backup enough?
Set the frequency from the recovery point objective agreed for each system, not from a default. Daily is the floor business.govt.nz sets for a New Zealand small business where the process is not automated, and it suits systems where a day of lost work is tolerable. Where losing a day would mean ringing customers to ask what they ordered, that system needs something shorter, which may be hourly or continuous depending on what the platform supports.
Do I need to back up Microsoft 365 or Google Workspace?
Usually yes, and check what each platform already gives you first. Service availability and recovery of your content after a deletion, a mailbox compromise or an expired retention policy are different commitments, and the built-in recovery features vary by product and plan. OneDrive, for example, keeps deleted items for ninety-three days on work or school accounts and holds version history. Those help without providing the extra recovery points and separation from the live service that a backup does.
How long should backups be kept?
Set backup retention around the recovery points each system needs, then handle record keeping separately. Inland Revenue requires business records to be kept for at least seven years, while information privacy principle 9 of the Privacy Act 2020 stops an agency keeping personal information longer than it lawfully needs it. A tiered scheme of daily, monthly and longer-term copies suits many systems, though a run of annual restore points does not establish that every required record was captured and remains readable.
How do you test a backup?
Restore something and check it opens. The NCSC asks for a single file restore at least quarterly and a full restoration at least annually, and its key takeaways go further, recommending a single file restore often and a full system restoration every couple of months. Test the scenarios you would actually face, including application rollbacks, database restores and a restore of the identity system, and measure the recovery time against the objective. Record the date and who ran it, because an untested data backup is unproven rather than known to work.
Can ransomware encrypt your backups?
Yes, and attackers look for them deliberately. The NCSC places the destruction of backups in the same attack phase as the encryption of your data, once the attacker already holds administrator credentials and has reached the backup servers. An offline or immutable copy is the one most likely to survive, provided the protection cannot be lifted by an account the attacker controls. Separating backup administration from everyday network administration helps, though automated jobs run under service identities rather than prompting for a code, so test whether compromised production credentials could change the settings, delete recovery points or reach the restore keys.
What does a data backup strategy cost a small business?
It depends on scope rather than headcount, since staff numbers do not determine data volume or recovery complexity. What drives it: how many systems and cloud services are protected, the data volume and how fast it changes, the retention required, whether immutable or offline storage is needed, how much recovery capacity you want available, plus licensing, monitoring and testing. The expensive version is the one bought after an incident.
Does Exodesk set up data backup for New Zealand businesses?
Yes. Exodesk has operated since 1989, with offices in Christchurch and Dunedin serving businesses across New Zealand, reviewing what is being copied, setting recovery objectives with the people who own the data, and putting a restore test on a schedule somebody signs.
NEXT STEP
When did anyone here last restore a file on purpose?
If the answer is nobody can remember, the backups are unproven rather than working. An IT assessment checks what is actually being copied, what the recovery objectives should be for each system, and whether a copy exists that a compromised account could not reach.
Or read more about our managed IT services.
