There are two kinds of company: those that have already lost data, and those that are going to. The difference between them rarely comes down to the sophistication of the tooling, but to three decisions taken before the incident.
The two figures that structure everything
Before choosing a tool, answer two questions.
How long can you stay down?
That is your target recovery time. An hour, a day, a week? The answer entirely determines the architecture. Recovery within an hour presupposes replicated infrastructure; recovery within forty-eight hours is content with an off-site backup.
How much data can you afford to lose?
That is the maximum acceptable loss. If your backup runs each night, you are implicitly accepting the loss of a day’s data entry. Is that sustainable for a company that invoices continuously?
These two figures, discussed with management and not with the technical team alone, are worth more than any comparison of products.
The 3-2-1 rule
Three copies of the data, on two different types of media, one of them off site. This rule is over twenty years old and remains the reference, because it covers the three real scenarios: hardware failure, human error and loss of the premises.
Add to it today a qualification that has become indispensable: at least one copy must be offline or immutable. Modern ransomware actively looks for connected backups and encrypts them along with production data.
The most frequent mistake
Never testing the restore. A backup that completes without error is not a valid backup: it is only a backup that did not report an error.
The restore test must cover a real case — restoring a specific folder, a complete database, an entire workstation — and be timed. That stopwatch is what will tell you whether your stated recovery time is credible.
What people systematically forget to back up
- Business mailboxes, often wrongly assumed to be backed up by the provider
- Network equipment configurations, which take days to rebuild
- Data stored on workstations rather than on the server
- Documents left in staff members’ personal storage spaces
- Certificates, licences and access credentials for external services
Write the procedure before you need it
On the day of the incident, the person who knows the system is on leave or unreachable. A written procedure, kept up to date and accessible outside the information system, makes the difference between a few hours and several days of downtime.
It should contain the order in which services are restarted, access credentials held securely, the contact details of suppliers, and what to communicate to customers.
Frequently asked questions
Does the cloud back up my data automatically?
A hosting provider guarantees the availability of its infrastructure, not the recovery of a file you deleted by mistake three weeks ago. Those are two different things. Check precisely what your contract covers.
How often should we back up?
As often as your acceptable loss requires. For a company entering orders all day long, a daily backup is not enough.
How long should backups be kept?
Long enough to cover corruption detected late. Retention over several weeks avoids discovering that all your copies already contain the problem.
How we work
Systomap designs and implements backup and recovery arrangements sized to the company, with documented restore tests. Let us review your situation.
