The 3-2-1 rule
Keep 3 copies of important data, on 2 different types of storage, with 1 copy off-site and offline or immutable (unchangeable). Ransomware deliberately hunts for connected backups to encrypt them too; the off-site, immutable copy is the one that saves you.
Is Microsoft 365 a backup?
Not really. Microsoft keeps its service running and offers recycle bins and retention features, but deleted items are only kept for limited periods (SharePoint's recycle bin holds items for up to 93 days, for example). Under Microsoft's shared responsibility model, protecting your data from deletion, corruption or ransomware is your job. A third-party Microsoft 365 backup is inexpensive insurance.
Test your restores
A backup you've never restored from is a hope, not a plan. At least quarterly, restore a file, a mailbox and — once a year — a whole system, and time how long it takes. That number is your real recovery time.
Backup checklist
- Microsoft 365 or Google Workspace backed up by a third-party service
- Laptops' important data in OneDrive/SharePoint, not on the desktop
- Servers and line-of-business systems backed up daily
- At least one immutable or offline copy
- Backup admin accounts protected with MFA and separate from everyday accounts
- Restores tested and documented
