How to choose · Backup and recovery
How to choose a business backup solution
Last updated 25 October 2026 · 3 sources listed · Reading time about 3 minutes
Short answer
Choose backup by what you must restore and how fast, then test it. Look for protection of every data source including cloud applications, immutable or offline copies that attackers cannot erase, separate credentials from your main environment, encryption, and restore testing you can actually perform. A backup that has never been restored is an assumption, not a control.
Who this is for: An owner or IT lead choosing how to protect servers, cloud services and workstations against deletion, hardware failure and ransomware.
What to evaluate
Coverage of all data sources
Gaps appear in cloud mail and file services, databases, laptops and configuration, which people wrongly assume are protected by the provider.
How to check: Make an inventory of systems and data and map each to a backup job with a named owner.
Immutability and isolation
Ransomware operators target backups first, so copies must resist deletion and encryption by someone holding stolen admin credentials.
How to check: Verify immutable storage settings, separate credentials and at least one copy that is offline or logically air-gapped.
Recovery speed and granularity
Restoring one file, one mailbox or an entire server require different capabilities and times.
How to check: Test restoring each type and record how long it takes against business tolerance.
Encryption and key handling
Backups contain everything an attacker wants, and lost keys can make data unrecoverable.
How to check: Confirm encryption in transit and at rest and document where keys are stored and who can access them.
Monitoring and alerting
Silent failures leave you with no usable copy when you need one.
How to check: Ensure failures raise alerts to a monitored destination and review job reports regularly.
Retention flexibility
Corruption or malicious change can go unnoticed for a while, so you need older versions available.
How to check: Check how long versions are kept and how legal or regulatory retention needs are met.
Comparison
| Approach | Good when | Watch out for |
|---|---|---|
| Local disk or appliance backup | Fast restores of large data on premises | Vulnerable to the same site disaster or ransomware if networked openly |
| Cloud backup service | Offsite protection without managing hardware | Restore speed over the internet and ongoing cost with data growth |
| Backup for cloud applications | You rely on hosted mail, files and collaboration tools | Assuming the application provider's retention equals a backup |
| Offline or removable media rotation | You want a copy no network attacker can touch | Human discipline and slower restores |
| Image-based whole-system backup | Need to recover entire servers quickly | Larger storage use and care with application consistency |
Decision worksheet
Rate up to three options against this guide’s own criteria. It runs in your browser and saves only on this device. It is a thinking aid, not a recommendation.
1. Have you checked each criterion?
0 of 6 criteria checked.
2. Compare options (0 = fails or unknown, 3 = meets it well)
| Criterion | |||
|---|---|---|---|
| Coverage of all data sources | |||
| Immutability and isolation | |||
| Recovery speed and granularity | |||
| Encryption and key handling | |||
| Monitoring and alerting | |||
| Retention flexibility | |||
| Total (max 18) | 0 | 0 | 0 |
Questions to ask before you commit
- Which systems and cloud services are covered, and which are excluded?
- Are backups immutable, and can anyone with administrative access delete them?
- Are backup credentials separate from our main directory and protected by strong authentication?
- How do we perform and document test restores?
- How long does a full restore of our largest system take over our connection?
- Who holds encryption keys and what happens if they are lost?
- What happens to stored data if we cancel the service?
- How are application databases quiesced to ensure consistent backups?
Typical trade-offs
Frequent backups versus system load and storage
- Upside
- Frequent copies reduce possible data loss.
- Downside
- Consume more storage and can affect production performance.
Cloud-hosted backup versus on-premises appliance
- Upside
- Cloud gives offsite resilience and minimal hardware upkeep.
- Downside
- Large restores depend on bandwidth and can take longer than expected.
Long retention versus storage cost and privacy duties
- Upside
- Long retention helps recover from slow-burning corruption.
- Downside
- Retains personal data longer and may conflict with deletion obligations.
Common mistakes
- Assuming cloud application providers back up your data for you. Their retention is usually for service resilience, not your recovery needs.
- Keeping backup consoles joined to the main directory with the same administrator accounts. Separate them.
- Never testing restores. Schedule regular restoration tests and record results.
- Backing up only data and not system configuration, identity directories or encryption keys needed to rebuild.
- Ignoring alerts from backup jobs. Assign someone to review them and escalate failures.
Related questions
Is cloud sync the same as backup?
No. Sync mirrors changes, including deletions and corruption, across devices, so an accidental deletion or ransomware encryption can propagate. Backup keeps independent, versioned copies you can roll back to. Some sync services offer version history, which helps but usually has limits and shares the same account as your live data. Treat sync as convenience and keep a separate backup under different credentials.
What does immutable backup mean?
It means stored copies cannot be changed or deleted for a defined period, even by administrators, so ransomware or a malicious insider cannot erase them quickly. Implementation varies: object storage with retention locks, write-once media or appliances with delayed deletion. Verify how the lock is enforced and who can override it, because some settings can be shortened by anyone with enough access.
How often should we test restores?
Often enough to be confident in each critical system, with schedules reflecting how important and how changeable it is. Test file-level restores regularly, full-system and application restores at planned intervals and a complete disaster scenario occasionally. Record time taken, problems and corrections. Different people should perform tests so knowledge does not sit with one person, and documentation should be good enough for a stranger to follow.
Do we need to back up laptops?
It depends on where data lives. If staff save work only in managed cloud or server locations, laptop backup may be unnecessary and replacing the machine is enough. If local files matter, protect them with a managed backup or move them to a protected location. Set a policy that says where business data must be stored, and verify it. Surprises usually come from desktop folders and local email archives.
Sources and further reading
These pages were reachable when we last checked. They informed definitions and rules referred to above; they do not endorse this guide. Where rules differ by country, check the authority for your location.
- Small business guide — National Cyber Security Centre, retrieved 27 October 2026
- StopRansomware — Cybersecurity and Infrastructure Security Agency, retrieved 27 October 2026
- Contingency Planning Guide for Federal Information Systems (SP 800-34 Rev. 1) — National Institute of Standards and Technology, retrieved 27 October 2026
Related guides
Comparison · Backup and recovery
Backup vs replication vs file sync vs snapshots
Backup keeps independent, versioned copies you can roll back to. Replication mirrors data to another site for fast failover but copies mistakes and corruption. File sync keeps files consistent across devices and also propagates deletions. Snapshots capture a point in time on the same storage and are fast but share its fate. Strong protection combines mechanisms rather than treating them as interchangeable.
Requirements · Backup and recovery
Setting recovery point and recovery time requirements
Recovery point objective is how much recent data you can afford to lose, and recovery time objective is how long a system can be unavailable. Set them per system by asking the business what an outage costs in operations, obligations and trust, then choose backup and recovery methods that meet them. Tighter objectives demand more cost and operational effort, so rank systems rather than demanding the same target for all.
Problems & fixes · Backup and recovery
Why backups fail when you need them and how to make them ransomware-resilient
Backups fail in predictable ways: attackers delete or encrypt them using stolen administrator access, jobs fail silently, restores are slow or incomplete, and keys or documentation are missing. Resilience comes from isolated or immutable copies, separate credentials, monitored jobs, regular restore tests and a rehearsed rebuild order that includes identity services.
How to choose · Artificial intelligence
How to choose a no-code workflow automation platform
Choose by the apps you must connect, the complexity of logic you need, how failures are surfaced, and how pricing scales with volume. Connector coverage and error handling matter more than a polished builder. Also check credential security, team access controls and how easily workflows can be exported if you outgrow the platform.
How to choose · Artificial intelligence
How to choose AI tools for analysing and searching company data
Look past demonstrations to three questions: can it reach the right data with the right permissions, can you verify how an answer was produced, and does it understand your business definitions. Evaluate connectors, semantic layer support, query transparency, access control inheritance, data movement and retention, and accuracy on your own hard questions.
How to choose · Identity and access
How to choose a single sign-on and identity provider
Choose an identity provider by checking which of your applications support standard federation, how provisioning and deprovisioning work, what authentication methods and policies are available, and how the provider behaves when it fails. The directory you already run, the number of unsupported legacy apps, and your admin capacity shape the best fit more than feature lists do.
How to choose · Artificial intelligence
How to choose an enterprise AI platform for company-wide use
Select on governance fit and integration depth before model capability. Verify identity and permission inheritance, data residency and retention, admin visibility into usage, evaluation and guardrail tooling, connector breadth into your systems of record, support for multiple model choices, and a commercial model that stays predictable as adoption spreads beyond the first enthusiastic teams.