“We have backups” is not the same as “we can keep running”. This guide explains the difference between backup, disaster recovery and business continuity, the 3-2-1-1-0 rule, why Microsoft 365 needs its own backup, and what recovering from ransomware actually looks like.
Backup, disaster recovery and business continuity
- Backup: copies of your data, so you can restore a file, a mailbox or a server.
- Disaster recovery (DR): the plan and systems to bring IT services back after a major failure, such as a server room outage, ransomware or a site loss.
- Business continuity (BC): how the whole business keeps operating during the disruption, covering people, processes, communication and suppliers, not just IT.
Two numbers make it practical. RPO (Recovery Point Objective) is how much data you can afford to lose. RTO (Recovery Time Objective) is how long you can afford to be down. These are business decisions, not IT ones: list your five most important systems and agree an RPO and RTO for each with the people who use them.
The 3-2-1-1-0 rule
- 3 copies of your data: the original plus two backups.
- 2 different types of storage, so one failure can’t take out both.
- 1 copy off-site or in the cloud, away from fire, flood and theft.
- 1 copy offline or immutable, so it can’t be changed or deleted, even by an attacker with admin rights.
- 0 errors: backups are checked and restores are tested.
Modern ransomware goes looking for backups first. If every copy is online and deletable, the attacker deletes them before encrypting anything.
“Microsoft backs up my Microsoft 365 data” is a myth
Microsoft keeps the service running; protecting your data is your responsibility. Recycle bins and retention features are designed for convenience, not disaster recovery: they keep content for a limited time, encrypted files sync to OneDrive and SharePoint like any other change, and a leaver’s mailbox and OneDrive can be deleted after a retention window. A dedicated Microsoft 365 backup gives you independent copies, longer retention and point-in-time restores.
A backup only counts once you’ve restored it
“Backup completed successfully” tells you a job ran. It doesn’t tell you whether the right data was included, whether it can be read back, or how long a full restore takes. Three habits fix that: restore one random file every month, run a full recovery drill once or twice a year, and name a person who owns it.
What recovering from ransomware looks like
- Detect and contain: Sophos endpoint protection with ransomware rollback stops encryption and isolates affected devices. With Sophos MDR, Sophos analysts monitor and respond around the clock.
- Restore clean copies from Acronis backups kept off-site or immutable.
- Follow the plan: a printed incident plan says who decides, who calls whom and who talks to customers.
- Close the door: find how they got in before reconnecting.
How Pentacle IT Solutions can help
Pentacle IT Solutions delivers backup with Acronis for servers, PCs and Microsoft 365, for businesses in Lucknow and across Uttar Pradesh. Restores are carried out by your team, with our guidance on testing them.
