Would your business know how much data it could afford to lose?

IT Desk can review your critical systems, establish suitable recovery requirements and implement protected, automated backups. We can also help test the recovery process so you know your data can be restored when it matters.

How frequently should business data be backed up?

There is no single backup frequency that is appropriate for every small business.

For many organisations, backing up important files at least once every day is a sensible starting point. However, a daily backup may not be frequent enough for systems where information changes throughout the working day.

For example, if a business processes customer orders every few minutes, a backup taken only once each night could leave an entire day of transactions at risk. That system may need hourly backups, frequent recovery points or continuous data protection.

A relatively static archive that changes only occasionally may not need to be backed up as frequently.

The schedule should therefore be based on the importance of the system and how quickly its information changes.

What is a Recovery Point Objective?

A Recovery Point Objective, usually shortened to RPO, describes the maximum amount of recent data a business could accept losing after an incident.

It is measured in time.

If a business could continue operating after losing up to 24 hours of changes, a daily backup may meet its requirements. If losing more than one hour of transactions would cause serious financial or operational problems, the system needs a recovery point at least every hour.

The simplest question to ask is:

The answer helps determine the required backup frequency.

Example backup frequencies for a small business

The following are starting points rather than universal rules:

Each system should be assessed individually. A business does not necessarily need the same backup schedule for every file, application and workload.

Is one backup per day enough?

One daily backup may be enough if the business can tolerate losing up to one working day of changes.

It may not be enough for systems that process frequent orders, appointments, payments, customer updates or operational records.

Businesses should consider the financial and practical consequences of recreating the information entered since the most recent backup. If recreating it would be difficult, expensive or impossible, more frequent protection is appropriate.

Should backups run automatically?

Yes. Wherever possible, business backups should run automatically.

Manual backups can be forgotten, delayed or performed inconsistently. Automated backup policies reduce dependence on individual employees remembering to copy data.

The backup system should also be monitored. A scheduled job is not useful if it has been failing unnoticed for several weeks.

Someone should be responsible for reviewing backup alerts, investigating failures and confirming that protected systems remain within the agreed schedule.

Does Microsoft 365 automatically back up business data?

Microsoft builds resilience and data-recovery capabilities into Microsoft 365, but businesses must still decide whether those capabilities meet their own retention and recovery requirements.

Microsoft also offers Microsoft 365 Backup for supported Exchange Online, OneDrive and SharePoint workloads. Other third-party backup services are available as well.

Features such as recycle bins, version history and service replication should not automatically be treated as a complete business backup strategy. They may not provide the required retention period, recovery control or protection from every deletion and account-related incident.

Read our guide to Microsoft 365 backup for businesses for a more detailed explanation.

Is an external hard drive enough for business backups?

An external drive can form part of a backup plan, but it should not normally be the only backup.

If the drive remains permanently connected to the computer or network, ransomware may be able to encrypt or delete the backup alongside the original information. It may also be affected by theft, fire, flooding or physical failure at the same location.

The National Cyber Security Centre recommends keeping backups separate from the systems they protect. This could include properly secured cloud backup storage or offline copies stored in a different location.

You can learn more about remotely stored protection in our guide to cloud backup.

How many backup copies should a business keep?

A business should avoid relying on one backup copy in one location.

Keeping multiple recovery points helps protect against situations where corruption, accidental deletion or malicious activity is discovered after the latest backup has already been created.

Backup retention should reflect:

• How quickly incidents are likely to be noticed

• Legal and contractual retention requirements

• The importance of historical versions

• Available storage and budget

• The sensitivity of the information

• How long the business may need to go back to find a clean copy

Older backups should not be retained indefinitely without a reason. Personal data should still be managed according to the organisation’s retention and data-protection obligations.

How often should backups be tested?

Backups should be tested regularly and after significant changes to systems or backup arrangements.

A restoration test confirms that the backup contains the expected data, remains readable and can be recovered within an acceptable timeframe. The test should also confirm that the correct people know how to begin and manage the recovery process.

The appropriate testing frequency depends on business risk. Critical systems may justify more frequent testing than static or non-essential data.

The NCSC advises organisations to know how to restore their files and regularly test that backups are working as expected. The ICO also expects organisations processing personal information to be able to restore access following an incident and to review the effectiveness of their security measures.

Businesses unsure about their existing recovery arrangements can use our Disaster Recovery Assessment to identify possible gaps.

What makes a backup reliable?

A reliable business backup should be:

• Automatic: It should not depend entirely on someone remembering to run it.

• Frequent enough: Its schedule should match the amount of data the business can tolerate losing.

• Separate: It should not be exposed to exactly the same incident as the original data.

• Protected: Access should be restricted and administrative activity monitored.

• Retained appropriately: Multiple recovery points should be available where required.

• Monitored: Failed or incomplete backups should generate alerts.

• Tested: The business should know that its data can be successfully restored.

Backup frequency matters, but recoverability is the real objective. A backup is only valuable if it remains available and usable when the original data is lost.