Company data backup in the cloud that works

If an employee accidentally deletes a folder, an email becomes a phishing target, or ransomware locks data, it doesn’t matter where the data was stored yesterday. What matters is whether the company can get it back quickly and securely. Company data backup in the cloud is therefore not simply off-site storage. It is business continuity protection that needs to be designed, monitored, and tested.

Many companies believe they are protected because staff work in Microsoft 365, files are in OneDrive or SharePoint, and business data is in a cloud solution. These services improve accessibility and collaboration, but they do not automatically resolve the company’s backup responsibility. For example, synchronisation can transfer deleted or corrupted files between devices. Backups must be able to preserve previous, clean versions that can be restored when something goes wrong.

Why cloud backup is a business matter

Data loss doesn’t just come from major cyberattacks. The most common incidents are often mundane: incorrect access grants too broad permissions, an employee overwrites a file, a laptop fails, or a system update causes an unexpected problem. When data is linked to financial accounting, contracts, projects, personnel matters, or customer service, even a minor incident can halt critical work.

The cost rarely lies just in the files themselves. It arises from lost work time, delayed deliveries, unhappy customers, and the time managers spend responding under pressure. A company that can clearly restore the correct data regains control of the situation. A company that doesn’t know if a backup exists, or if it works, has to make decisions in uncertainty.

Cloud backup can also support retention, traceability, and security requirements. But this depends on the nature of the data and the regulations under which the company operates. It is not correct to retain all information indefinitely. A good backup policy defines both what needs to be retained and when information needs to be securely deleted.

The cloud alone is not a backup

It is useful to distinguish between service provision, synchronisation, and actual backup. Cloud services can ensure high uptime of their own infrastructure, and synchronisation keeps files accessible on more than one device. Neither, on its own, guarantees that the company can select a specific version from a particular time, restore individual mailboxes, or rebuild data after an attack.

Backups must take place separately from the source data. The separation can be technical, with a dedicated backup system, administrative access and retention policies that do not follow normal user access. It also needs to be operational. The person who falls victim to phishing should not be able to delete backups at the same time as losing access to the work environment.

Immutable backups, where data cannot be modified or deleted within a defined retention period, are a particularly important defence against ransomware. They are not an excuse for weak access controls or unpatched devices. However, they provide the company with a realistic last line of defence when other security layers fail.

What should cloud data backups for businesses cover?

The correct scope is determined by what keeps the operation running. For some companies, this is primarily Microsoft 365 data, such as email, Teams communications, OneDrive, and SharePoint. For others, business systems, databases, file servers, workstations with specialised software, or employees' laptops are equally important.

Start with a simple question: What data would we need to recover to be able to serve customers tomorrow? The answer usually shows the prioritisation better than a long technical report. Then, you need to confirm where the data resides, who is responsible for it, and what the interdependencies between systems are.

It is useful to categorise data into four main groups:

• Daily operational data, such as contracts, project records, and customer communications.
• System data, including configurations, virtual machines, databases, and applications that the operation relies on.
• End-user device data on laptops and desktops, especially where employees work remotely.
• Sensitive data that requires stricter access control, longer or shorter retention periods, and precise recovery processes.

Not all these categories necessarily require the same backup. An important database might need frequent backups and a short recovery time. Older documents might require cheaper long-term archiving. The goal is not to buy the most storage space, but to protect the right data at the right speed and with predictable costs.

Two concepts managers need to understand

When setting up backups, RPO and RTO are often mentioned. The terms sound technical, but they answer two direct operational questions.

RPO indicates how much data loss the company can tolerate, measured in time. If backups are taken every four hours, the last four hours of work could be lost in a serious incident. RTO, on the other hand, indicates how long the operation can wait for recovery. Can the sales team wait a day for access to data, or does a key system need to be operational within hours?

It is tempting to demand almost no data loss and immediate recovery for everything. Such a demand significantly increases costs and complexity. A better approach is to set realistic goals based on business impact. Backup then becomes part of responsible cost management rather than an undefined insurance.

Untested backups are an assumption, not proof

The biggest mistake in backup is only monitoring whether backup jobs have finished. A green status indicator shows the system attempted a backup. It does not prove that files can be opened, systems can be booted, or data can be recovered within an acceptable timeframe.

Tests must reflect real incidents. Recover a single file. Try to retrieve a mailbox or SharePoint site. Confirm that a critical system can be booted from a backup or restored in an isolated environment. Record how long the process took and who made the decision. This way, weaknesses are revealed before they become emergencies.

Also test access. If an administrator's password is lost or access is blocked after an attack, who can initiate recovery? Strong passwords, multi-factor authentication, and secure management of privileged access are part of the backup solution, not add-ons.

Security and responsibility must go hand in hand

Backups often contain a company's most valuable information. They therefore require the same or greater protection than production data. Data should be encrypted both in transit and at rest. Access must follow roles, not convenience, and changes to retention policies or deletion of backups must be traceable.

There must also be clear responsibility. Who receives notifications when a backup fails? Who follows up on them? Who assesses whether a new system or new data source should be included in the backup strategy? When no one is assigned this task, backup often ends up as a forgotten setting in one system, until it turns out not to cover what matters most.

For small and medium-sized businesses, it makes sense to entrust an IT operator with daily monitoring of backups, responding to deviations, and conducting regular recovery tests. The internal team can then focus on the business, while still having a clear view of the status of protection, costs, and risks. nexIT works with companies in this way: by linking daily system management, network security, and recovery into a single chain of responsibility.

Start with a realistic assessment, not a new tool

A new backup solution does not fix unclear responsibility or an unknown data landscape. The first step is to map critical systems, data, access, and business impact. Then, retention periods, RPO, RTO, and necessary security levels can be defined. Finally, monitoring and tests must be set up to confirm that the plan holds up when it matters.

Simply ask: If we lost access to this data right now, what could we get back up and running by the end of the day? The answer is a good starting point for a backup that protects not just files, but the company’s ability to keep going.