Many SMEs have implemented an IT backup system. Few have verified that it actually works. Even fewer have simulated a full restore. And very few know exactly where their data copies are located or if they would survive a fire.
It is not a lack of good intentions. It is a lack of review.
A backup solution is set up, it runs in the background, the logs are green, and no one touches it for years. The problem is that threats have changed: today's ransomware doesn't just encrypt production data; it actively hunts for backups connected to the network. Cloud synchronization like OneDrive or SharePoint propagates deletions and corruption in real time.
A backup is insurance. Like any insurance, it is only useful if you have verified that it actually covers what you need.
Storing the copy in the same location as the data. Fire, water damage, hardware theft: if your copy is in the same room as the servers, you don't have a recovery plan; you have two identical risks.
Confusing synchronization with backup. Synchronization replicates changes in real time, including accidental deletions and ransomware encryption. A true backup is a snapshot frozen in time, restorable to the state prior to the incident.
Never testing the restore. A backup with green logs is not a validated backup. We regularly encounter copies that run without visible errors but whose restored files are corrupted or incomplete.
No defined RPO or RTO. The RPO (Recovery Point Objective): how far back in time can you go? The RTO (Recovery Time Objective): how quickly must we be operational? Without answers, it is impossible to know if your solution matches what your business can afford to lose.
A backup accessible to ransomware. If your copies are write-accessible from the network, ransomware can encrypt them at the same time as your production data. The answer: immutable backup, write-only copies for a defined period that nothing and no one can modify or delete.
A data incident without a reliable recovery plan rarely looks like an immediate total shutdown. It looks more like two days without access to accounting at the end of the month, lost client quotes, or a database restored four days late. For an SME of 20 to 50 people, that means tens of thousands of francs in direct losses, not to mention the impact on client trust.
An industrial SME with about forty employees. On the surface, everything seemed fine: tape backups were running every night with several weeks of history. The problem was that the tapes were stored in the server room, just two meters away from the server they were supposed to protect. In the event of a fire, both the production data and the backup copies would have been lost together.
Three complementary solutions were proposed: a fireproof safe for recent tapes, a weekly rotation with off-site storage, and eventually migrating critical data to a secure cloud. The client opted for the safe and off-site rotation.
The 3-2-1 rule remains the gold standard: 3 copies of your data, on 2 different media, with 1 stored off-site.
Test your restoration process at least twice a year in an isolated environment: perform an actual restoration of critical files and validate their integrity, rather than just checking logs.
Keep at least one copy off-site, either physically or in the cloud. Implement immutable backups if ransomware is a realistic threat (our typical setup: Veeam with an immutable target and encrypted off-site copy). Define your RPO and RTO with your IT provider, even if just as a guideline.
An untested backup is an unverified promise. And a copy stored right next to what it protects is just a second point of failure. The real question isn't "am I backing up my data?", it's "if everything went up in smoke tonight, could I get my business back up and running tomorrow morning?"
