RPO defines how much data the company can lose; RTO defines how quickly operations should be restored.
Translates backup into acceptable downtime and data loss.
Business cybersecurity
Business backup that must be restorable
Backup only matters when the company knows what is protected, how fast recovery is possible and whether restoration has been tested.
Key risk
Backup exists, but can the company be restored from it
Many companies have backups, but they are not sure whether work can be restored after a failure or ransomware attack. The problem often appears only when a server stops working, data is encrypted or someone accidentally deletes important files.
Practical context
Terms and information that make the decision easier
These short explanations help discuss risk without going too deep into technical detail.
A copy that cannot be easily changed or deleted for a defined period.
Reduces the risk of backup deletion during ransomware or administrator error.
A copy separated from the production environment.
Adds a recovery layer if an attack reaches primary systems.
Scope and approach
What to know before the next step
What effective backup means
Backup is not effective just because something is being copied. Effective backup means the company knows what is copied, where the copy is stored, how long it is retained, who is responsible for recovery and how long returning to work will take.
What business backup should cover
The scope depends on the environment, but it should be broader than one folder with files.
- physical and virtual servers
- databases and business applications
- file shares and documents
- Microsoft 365 data
- system and device configurations
- documentation needed to restore work
Restore testing
The most important backup test is restoration. Without a test, the company does not know whether the copy is complete, whether the procedure works and how long returning to work will take. Aptigo helps perform restore tests and organize procedures so backup becomes part of the business continuity plan.
Protection against ransomware
In many cases, offline or immutable copies are worth considering, meaning copies that cannot be easily changed or deleted after an attack. Retention, versioning, monitoring of backup errors and a clear response procedure are also important.
RPO and RTO without jargon
Backup should match how much data the company can lose and how long it can wait for work to return. RPO defines acceptable data loss, while RTO defines recovery time. Without these values, a company may have backups that technically exist but do not match business needs.
What we check in a backup audit
A backup audit shows whether copies cover the right data and whether they can be restored when the company really needs them.
- scope of protected systems and data
- retention and versioning
- copies outside the main location
- resistance to deletion or encryption
- error monitoring
- restore testing and recovery time
Microsoft 365 backup
Email, SharePoint, OneDrive and Teams often contain critical business information. Microsoft 365 backup should be treated separately: not only as service failure protection, but as the ability to recover data after user error, deletion, incident or account takeover.
Example restore test
A test may include restoring a selected file, mailbox, folder, virtual machine or system. The result, restore time, data scope and conclusions should be recorded. Only such a test tells management whether backup supports business continuity.
FAQ
Common questions
Is cloud backup alone enough?
Not always. What matters is the scope of data, retention, ability to restore, resistance to deletion and whether someone monitors copy errors.
How often should restore testing be done?
The frequency depends on how critical the data is, but the test should be recurring and documented. Without a test, the company does not know its real time to return to work.
Does Microsoft 365 need separate backup?
In many companies, yes, because email, OneDrive, SharePoint and Teams data can also be deleted, encrypted or overwritten. Retention and recovery requirements should be checked.
Is a successful backup job report enough?
No. A job report is important, but only restore testing shows whether data is complete and usable after a failure.
See also
Related topics
These pages explain the broader service context and lead to the next step.
Next step
Want to check the risks in your company?
A short consultation helps decide whether the first step should be an audit, security implementation or managed IT Security support.