Backing up your business data is essential, but simply having a backup doesn't necessarily mean your business is prepared to recover from a data-loss event.

Where your backups are stored, how they are protected, how often they are tested, and how they fit into your overall disaster recovery strategy all matter.

Below are answers to some of the most common questions businesses have about backup redundancy, data protection, and disaster recovery.

How many backups should a business have?

There isn't one number that is appropriate for every business, but the 3-2-1 backup strategy provides a strong starting point: three copies of important data, two different storage types or environments, and one copy stored offsite.

Your specific backup requirements should be based on your business's recovery needs, data, risk, and tolerance for downtime or data loss.

The Cybersecurity and Infrastructure Security Agency (CISA) specifically recommends the 3-2-1 approach as a way to increase your chances of recovering lost or corrupted data.

Should business backups be stored in different locations?

Yes. Keeping at least one recovery copy offsite helps protect against physical disasters affecting your primary location.

If a fire, flood, theft, or other event affects your office, an offsite backup can provide another path to recovering your business data.

Geographic separation is an important part of building a resilient backup strategy.

Can ransomware affect backups?

Yes.

If backup systems are accessible from a compromised network, ransomware or an attacker with sufficient privileges may be able to encrypt, delete, or otherwise compromise backup data.

That's why backups should be appropriately protected and, where possible, isolated from the primary environment.

NIST recommends keeping backups isolated so ransomware cannot readily spread to them. NIST also recommends developing and testing a backup and restoration strategy.

Having multiple copies isn't enough if all of those copies can be affected by the same attack.

How often should business backups be tested?

The appropriate testing frequency depends on the business and its recovery requirements.

What matters most is that restoration is tested regularly enough to provide confidence that your organization can actually recover its critical systems and data.

A backup that reports "successful" isn't necessarily a backup you can successfully restore.

NIST recommends organizations plan, implement, and regularly test their data backup and restoration strategy.

For businesses working with an IT provider, NIST also provides guidance specifically focused on conducting, maintaining, and testing backup files as part of a managed IT environment. (NIST backup guidance for managed service providers)

Is cloud backup enough for a business?

Cloud backup can be an important part of a business's data protection strategy, but it shouldn't automatically be considered a complete disaster recovery plan.

Businesses should consider:

• Backup retention

• Security and access controls

• Recovery procedures

• Provider dependencies

• Recovery time

• Additional backup copies

• Protection against ransomware and account compromise

The cloud can be one part of a resilient backup strategy.

It shouldn't be the only question you ask.

What is the difference between backup and disaster recovery?

A backup is a copy of data that can be used for recovery.

Disaster recovery is the broader strategy for restoring technology, data, applications, and business operations after a significant disruption.

In other words, a backup helps you recover your data. A disaster recovery plan helps you figure out how to get your business back up and running.

Both are important components of business continuity.

Protect Your Business Before You Need to Recover

The best time to evaluate your backup and disaster recovery strategy is before you experience a data-loss event.

A resilient strategy should give your business multiple ways to recover if something goes wrong.

If you're a business in the Philadelphia area and you're not sure whether your current backup strategy provides enough redundancy, EMCO Technology can help evaluate your environment and identify potential gaps.

Learn more about EMCO's Backup Services or Disaster Recovery Services to see how backup and recovery can fit into a broader IT strategy.

Your data is too important to put all in one basket.