| A data backup strategy is the set of decisions covering what gets copied, how often, where the copies are held, how long they are kept, and how the restore is proved to work. New Zealand’s National Cyber Security Centre states the shape as 3-2-1-1: three copies of the data, on two different kinds of media, with one copy offsite and one copy offline. |
A Timaru freight operator ran nightly backups for four years and never restored from them once. The job reported success every morning and the report went to an inbox nobody opened.
When a server failed on a Tuesday in March the restore ran for nine hours and returned the file share without any of the databases. The data backup job had been pointed at the wrong volume since a disk was swapped in 2023. Nobody had checked it since.
The reports had been green throughout. A backup that runs is not a data backup strategy. The difference only shows on the day somebody needs it.
That firm was trading again in four days, rebuilt from paper dockets and a supplier’s copy of the invoices. Four days of a 22 person operation running on manual process is the number to set against the cost of testing a restore.
The numbers here are illustrative. Work out your own by answering two questions about your worst system: how much work would you lose, and how long would you be down.
Owners can usually answer the first and not the second. Everything below is about turning both into figures somebody has checked.
How Do You Know If Your Backups Work?
You do not, until somebody restores something and checks it opens. In most small businesses the software reports success, somebody glances at the email, and the first genuine restore attempt happens during the incident the backups were bought for.
Nobody involved is being careless. Backup software reports on whether the job finished, not on whether its contents are the files you would ask for, so a data backup job pointed at an empty folder reports success every night for a year.
There is a second failure that hides just as well. A restore that technically works but takes eleven hours is a failure if the business needed the system back in two, and nothing in the nightly report tells you which one you have.
A data backup strategy exists to close both gaps. Somebody has to own the question of whether the copies come back and how fast. In most firms nobody has been handed it.
The NCSC treats testing as part of the control itself. Its guidance on how to implement and test backups asks for a single file restore at least once a quarter and a full restoration at least once a year.
Test the scenarios you would actually meet, not the one the software demonstrates. A file restore after somebody deletes the wrong thing, an application rollback after a bad upgrade, and a database restore after a server failure are three different tests of the same data backup, and an application that depends on its database has to be tested with it.
Write down who ran the test and what came back. A dated line saying the June restore returned the job system in 40 minutes against a two hour objective is worth more to an insurer, an auditor or a nervous client than any description of the software.
This post covers the shape of the backups themselves. Writing the decisions down and keeping them current belongs to the backup and recovery plan. Keeping that document current is a separate job from deciding what the backups themselves are supposed to do.
What Is the 3-2-1-1 Backup Rule?
Three copies of your data, held on two different kinds of media, with one copy offsite and one copy offline. The NCSC publishes the data backup model in that form, and the fourth digit is the one small businesses are missing.
The older 3-2-1 version stopped at offsite, which made sense when the threat was fire, flood and theft. An offsite copy that stays connected to the network is still reachable by anything that reaches the network.
Offline means disconnected. A drive unplugged between runs, tape in a cabinet, or immutable cloud storage the backup account has no permission to delete all qualify. The test to apply is whether a compromised administrator account could destroy that copy in an afternoon.
Two media types matter for a duller reason. A firmware fault or a format problem takes out every copy on the same kind of device at the same time. A second format breaks that chain.
You also have to assume one of those copies goes missing. A backup is a second full copy of everything the business holds, so it needs protecting at rest, and the NCSC points at the NIST recommendation of the Advanced Encryption Standard with 256-bit keys. Where a copy leaves the building on a drive, encryption separates a lost device from a notifiable privacy breach.
Counting your own copies is a five minute exercise, and it is the fastest way to tell whether you have a data backup strategy or a habit. Most firms find they have two, both on disk, both in the same building, and both mounted to the same server that would be encrypted first.
Count carefully if you use OneDrive or Dropbox. A folder that replicates to either is one copy in two places, and a file deleted or encrypted on the laptop is gone from the cloud within seconds. Neither location is doing the job of a data backup, whatever the storage bill says.
Most data backup failures in a small business come down to one of these four numbers reading zero. None of the four is a software problem, and no product decides any of them for you.
What Should a Data Backup Strategy Include?
Five settings: frequency, type, retention, media and location, as the NCSC lists them. Each is a business decision before it is a technical default, and the values the software installed with were not chosen for your business.
Frequency is how often the job runs. Type is how much moves each time, and the practical choice is between copying everything overnight or copying only what changed since last night.
Retention is how long a copy is kept before it is overwritten. Media is what the copy is written to. Location is where that media lives, and whether one earthquake or one burst pipe would reach the original and the copy together.
| Setting | What it decides | A common small business answer |
|---|---|---|
| Frequency | How much work a failure can cost you | Nightly, with hourly on the sales or job system |
| Type | How long each run takes and how much it stores | Weekly full copy, incremental every other night |
| Retention | How far back you can reach, and the storage bill | 30 daily, 12 monthly, 7 annual |
| Media | What the copy survives | Disk on site, plus cloud object storage |
| Location | Whether one event reaches both copies | One copy off the premises, one copy offline |
Before any of the five can be set, somebody has to list what the business actually holds. Customer records, financials, the job management system, the shared drive, the mailboxes, the configuration of the phone system. A data backup strategy built from an inventory covers all of it, and one built from a default install covers whatever was on the server that day.
Give each of those a named owner. The person who would have to recreate the data can say how much of it matters, and the technical settings exist to serve that answer. Nobody in IT can supply it for them.
One decision has no software setting attached, so it gets skipped. Backup media wants a locked cabinet away from water and heat, with access limited to the people who run the function. It is the standard you would already apply to a filing cabinet of personnel records.
The work in a small business is deciding these five once, recording what was decided, and checking twice a year that the running systems still match. Systems get added, and a data backup strategy that was accurate in March covers a server nobody had bought in August.
What Are RPO and RTO in a Data Backup Strategy?
RPO is the recovery point objective and RTO is the recovery time objective, and between them they decide almost everything else. The recovery point objective is how much work you are prepared to lose, measured in time, and it sets how often the data backup runs. The recovery time objective is how long you can be down, and it sets where the copies live and what they are written to.
The NCSC frames both as objectives the data owner sets and the IT team advises on, with a common default recovery point objective of one day.
A day of lost work is an irritation for a document library and a serious problem for a sales ledger. Set the numbers per system, because one figure for the whole business comes out either too expensive for the low value systems or too weak for the high value ones.
The recovery time objective is the one that costs money. A copy in cloud storage is cheap to hold and slow to pull back down, and a local copy in a locked cabinet restores fast and burns shelf space. Businesses with a short objective on one system end up holding both for that system and only the cheap copy for everything else.
The numbers also settle arguments that otherwise go in circles. When somebody asks whether the data backup spend is too high, the honest answer is a comparison between what the current setup delivers and what the business said it needed. Without the two numbers written down there is nothing to compare it against, and the argument stays a matter of opinion.
Where the recovery time objective comes in under a day, the conversation stops being about data backup and moves to standby systems, and the difference between backup and BCDR covers that ground.
Write both numbers next to each system. A data backup strategy without them is only a preference, and there is no way to tell whether the current setup meets it.
How Often Should a Small Business Back Up Its Data?
At least daily where the process is not automated, which is the floor business.govt.nz sets for New Zealand small businesses. Automate it and the question stops depending on somebody remembering.
Systems where a day of lost work would mean ringing customers to ask what they ordered need something shorter than daily. Continuous or hourly protection on a sales system and a nightly run on everything else is a common and affordable split.
Ask what your cloud providers are actually promising. They guarantee that their own infrastructure stays up. Getting your data back after somebody deletes it is a separate question, and often a separate product.
Check Microsoft 365 first. The retention settings inside it are not the same thing as a data backup, and the gap that leaves is what Microsoft will not restore.
The same question applies to every other system the business signs up to. Accounting platforms, job management tools and payroll all hold data the business would have to recreate by hand. Very few of them are covered by whatever runs on the office server at night, and the ones that are not have to be exported or backed up separately.
There is a ceiling on how often you can run this. Large jobs scheduled close together can overlap, where a second run starts before the first has finished, and the fix is a talk about the recovery point objective and not a bigger pipe.
Put the data backup schedule where somebody will see it break. An alert on a failed job, sent to a named person and not a shared mailbox, catches in a morning what a green report would hide for a year.
How Long Should You Keep Backups?
Long enough to satisfy the rules that apply to you and no longer. For most small businesses that means thirty daily copies, twelve monthly copies and seven annual ones. Those two halves pull against each other.
Tax records have to be kept for seven years. Employment records, contracts and financial statements all carry their own periods, and none of them is shortened by the fact that the only surviving copy is inside a data backup.
Pulling the other way, information privacy principle 9 of the Privacy Act 2020 says an agency must not keep personal information for longer than is required for the purposes for which it may lawfully be used. A backup set with no retention limit becomes the place old personal information lives on indefinitely.
The practical answer is tiered. Keep daily copies for a month, monthly copies for a year, and annual copies for as long as the record-keeping rules require, then let everything else expire on schedule.
This becomes real the first time a customer asks you to delete their information. The record comes out of the live system in minutes and stays inside every data backup until the retention period runs out. Give them the date it expires.
It also decides your storage bill, and few businesses move it off whatever the software installed. Read it before the invoice makes you.
Why Do Ransomware Attackers Destroy Backups First?
Because a business that can restore does not pay. The NCSC’s ransomware lifecycle puts destroying backups in the same phase as encrypting the data, after the attacker has already reached backup servers and administrator credentials.
That is the whole argument for the offline copy. An attacker holding domain administrator rights can reach every connected copy in the environment, and the NCSC calls offline or disconnected backups critical to recovery for exactly that reason.
It also changes what counts as a good data backup strategy. Restore speed used to be the thing to design for, and the first question now is whether a compromised account could delete the copy at all.
This comes down to which account the backup runs as. Where the backup system signs in with the same domain administrator account used to run the network, one stolen password reaches the servers and the data backup together. A dedicated account with its own multi-factor authentication breaks that chain, and it costs nothing beyond the time to set it up.
The same blind spot shows up across the wider set of assumptions businesses make about ransomware. A backup is the only control that still helps once an attacker is inside and holding administrator rights.
Set alerts and read them. A failed job, a change to a data backup configuration and somebody logging in to the backup server should each raise one, and each should be handled as an incident.
When Did You Last Restore Something You Needed?
If nobody can name a date, assume they do not work. Getting to a tested data backup is a morning of decisions and a recurring diary entry. Nothing in it needs new software or a bigger monthly bill than the one you already pay.
Exodesk has supported South Island businesses since 1989 and works with clients across Canterbury, Otago and Southland from offices in Christchurch and Dunedin. Our cloud and infrastructure team reviews what a business is actually copying, sets the two recovery numbers with the people who own the data, and puts a restore test on a schedule that somebody signs.
The work is unglamorous. It is finding the volume nobody repointed after a disk swap. Then proving on an ordinary Wednesday that the copy comes back.
Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.
Frequently Asked Questions
Is a data backup strategy the same as backup software?
No. The software runs the jobs, and the strategy is the set of decisions covering what is copied, how often, where the copies are held, how long they are kept and how the restore is verified. Two businesses running the same product can have a sound strategy and a useless one.
Is the 3-2-1 backup rule still enough?
No, and New Zealand’s National Cyber Security Centre now publishes a 3-2-1-1 model in its place. The extra digit calls for a copy held offline, disconnected from the network altogether. The original rule assumed the danger was fire, flood or theft, where getting a copy off the premises was sufficient. Ransomware changed that, because an attacker working inside your network reaches every copy the network can reach.
What is the difference between a backup and a data backup strategy?
A backup is a copy. The strategy is the reasoning that decided which copies exist and then proved they restore, so a business can hold four years of backups and still have none. The first real restore is where that gets discovered.
What does RPO mean in backup?
Recovery point objective is the amount of work you are willing to lose, expressed as time. An RPO of 24 hours means you accept losing up to a day of changes, and it sets your data backup frequency. The NCSC notes one day as a common default and a much shorter figure for systems like online sales.
What is a recovery time objective?
Recovery time objective is how long the business can be down before the restore has to be finished. It decides where the copies are stored and on what. Pulling several terabytes out of cloud storage takes considerably longer than reading the same volume off a disk in the server room, so a short RTO usually means paying to keep a local copy as well.
Is a daily backup enough?
For most systems yes, and daily is the floor business.govt.nz sets for a New Zealand small business where the process is not automated. Anything holding orders, payments or clinical records needs hourly or continuous protection, because a day of lost transactions means ringing customers to ask what they bought. Set the frequency from the recovery point objective, not from whatever the software installed with.
Do I need to back up Microsoft 365 or Google Workspace?
Yes, because both providers guarantee their own service availability and not the recoverability of your content after a deletion, a mailbox compromise or a retention policy that expired something you needed. The built-in retention features help and they are not a data backup.
How long should backups be kept?
Long enough to meet your record-keeping obligations and no longer. Tax records run to seven years in New Zealand, while information privacy principle 9 of the Privacy Act 2020 stops an agency keeping personal information longer than it lawfully needs it. A tiered scheme of thirty daily copies, twelve monthly and seven annual satisfies most small businesses.
How do you test a backup?
Restore something and check it opens. The NCSC asks for a single file restore at least quarterly and a full restoration at least annually. It also recommends testing the scenarios you would actually face, including application rollbacks, database restores and a restore of the identity system. Record the date and who ran it, because an untested data backup and a missing one cost the same on the day.
Can ransomware encrypt your backups?
Yes, and attackers look for them deliberately. The NCSC places the destruction of backups in the same attack phase as the encryption of your data, once the attacker already holds administrator credentials and has reached the backup servers. An offline or immutable copy is the control that survives that, because it cannot be deleted by an account inside the network. Running the backup system on its own credentials, separate from the domain administrator account, closes most of the rest.
What does a data backup strategy cost a small business?
The design work is usually half a day to a day, and the ongoing cost is storage plus about an hour a quarter for testing, with cloud storage for a typical 20 person firm running in the tens of dollars a month. The expensive version is the one bought after an incident.
Does Exodesk set up data backup for New Zealand businesses?
Yes. Exodesk works with businesses across Canterbury, Otago and Southland from offices in Christchurch and Dunedin, reviewing what is being copied, setting recovery objectives with the people who own the data, and putting a restore test on a schedule. We have operated in the South Island since 1989.
NEXT STEP
When did anyone here last restore a file on purpose?
If the answer is nobody can remember, the backups are unproven rather than working. An IT assessment checks what is actually being copied, what the recovery objectives should be for each system, and whether a copy exists that a compromised account could not reach.
Or read more about our managed IT services.
