Business backup today no longer answers the question "do we have a copy of our data", but rather "can we actually restore the business from it, and how quickly". Disks fail, employees delete the wrong folders, and ransomware deliberately hunts down and destroys backups before it locks production systems. NeoBit designs, implements and monitors data backup and disaster recovery for small and medium sized businesses: from assessment and planning, through Veeam backup and an offsite cloud copy, to regular recovery testing with proof that restoration actually works. Below, we explain what a backup that survives even the worst case scenario looks like.
Why backup is not optional
Data is the only part of an IT system that cannot be bought again. A server, a laptop or network equipment can be replaced within days; lost quotes, contracts, accounting records and your customer database cannot be recovered by anyone. The causes of data loss are entirely mundane: disk failure, a stolen laptop, fire or flood in the server room, human error and, increasingly often, targeted attacks.
The most important change of recent years: ransomware does not just encrypt production, it first finds and deletes backups. An attacker who gains administrator privileges in the domain will delete Windows shadow copies, wipe a backup server that is a member of the same domain and encrypt any NAS reachable over the network. If all copies are online and accessible with the same accounts as production, at the moment of the attack you do not have a backup, just another encrypted location. That is why offline or immutable copies are a mandatory part of every serious strategy, something we cover in more detail in our guide to ransomware protection.
The mistakes we see most often in practice
- Backups are stored on the same server or a NAS on the same network, with no offsite copy.
- The backup repository is accessible with the same administrator accounts as production.
- Copies are not encrypted, so a stolen disk also means a data leak.
- Recovery has never been tested, so the first test happens in the middle of an incident.
- Nobody checks whether backup jobs even completed; the failure is discovered only when a restore is needed.
The 3-2-1 rule: the foundation of every backup strategy
The gold standard is the 3-2-1 rule: three copies of your data, on two different media, with one copy kept offsite. For defense against ransomware we recommend the extended 3-2-1-1-0 rule: at least one copy must be offline or immutable, so that an attacker cannot delete it even with stolen administrator credentials, and recovery tests must finish with zero errors. How the rule works in practice, which technologies support it and how to introduce it step by step is described in a separate guide: the 3-2-1 backup strategy.
What we offer: backup and disaster recovery as a service
We do not sell software and leave you holding a license. We run backup as a service, with clearly defined recovery objectives and responsibility for the result:
- Assessment and plan. We inventory your systems and data, determine what is critical, how much data you can afford to lose and how long you can afford to be down. The result is a backup plan with priorities and clear costs.
- Implementation. We deploy Veeam backup and proven technologies for physical and virtual servers, databases, workstations and Microsoft 365. Yes, Microsoft 365 needs its own backup too: Microsoft guarantees service availability, not the preservation of your deleted data.
- Offsite and cloud copy. A second copy outside your premises, typically a cloud backup to a data center in the EU, with an immutable repository that ransomware cannot delete.
- Encryption. All data is encrypted both in transit and at rest (AES-256). A stolen medium or intercepted traffic does not mean a data leak.
- Recovery testing. Regular test restores of files, entire servers and databases, with documented results. A backup that has not been tested is treated as if it does not exist.
- Monitoring. Every backup job is tracked automatically; a failed job is an alarm we resolve the same day, not a line in a report nobody reads. Backup monitoring is part of our broader IT infrastructure management service.
RTO and RPO: the two numbers that define recovery
A conversation about backup becomes concrete only once two numbers are agreed: RPO and RTO. They determine the technology, the frequency of copies and the price, so it is important to understand them before any proposal.
| Term | Full name | What question it answers | Example |
|---|---|---|---|
| RPO | Recovery Point Objective | How much data (hours of work) can we afford to lose? | RPO of 4 hours: a copy is made every 4 hours, so in the worst case you lose up to 4 hours of entries. |
| RTO | Recovery Time Objective | How long can we afford to be down before the system is back? | RTO of 2 hours: the server must be running again no later than 2 hours after the outage. |
A real world example: an accounting firm can tolerate losing half a working day of entries (RPO of 4 hours), but must not be down for more than one working day (RTO of 8 hours). An online store receiving orders every few minutes needs an RPO of 15 minutes and an RTO of one to two hours. The smaller the numbers, the more demanding and expensive the solution, which is why objectives are defined per system rather than as a flat figure for the whole company:
| System | Typical RPO | Typical RTO |
|---|---|---|
| ERP and databases | 15 min - 1 hour | 1 - 4 hours |
| Email and Microsoft 365 | 1 - 4 hours | 2 - 8 hours |
| Shared files | 4 - 24 hours | 4 - 8 hours |
| Archives and older projects | 24 hours | 1 - 3 days |
Disaster recovery plan: more than a copy of your data
Backup answers the question "where is the data", while disaster recovery answers "how do we turn that data back into a working business". In the middle of an incident there is no time to improvise, which is why the DR plan is written and rehearsed while things are calm. A good plan includes:
- Restore order: first the network and the domain, then databases and the ERP, then email and other applications. The wrong order can extend recovery by an entire day.
- Roles and contacts: who makes decisions, who restores systems, who informs employees, clients and partners.
- Alternative infrastructure: where systems are brought up if the primary site is unavailable - spare hardware, virtualization or temporary operation from the cloud.
- Documented procedures: recovery steps must not depend on the memory of a single person who may be on vacation.
- Drills: at least once a year, a simulation of a serious outage, measuring the actual recovery time and comparing it with the agreed RTO.
We create and maintain DR plans together with our clients, and for companies without their own IT department it is a natural part of ongoing IT support for business: the same team that maintains your systems every day is also the fastest at bringing them back online.
How to get started
The first step is an assessment of the current state: what is backed up today and what is not, where the copies are kept, and whether the business could actually be restored from them. The assessment is free and comes with no obligation. Contact us via the form on this page, by email or on WhatsApp, and within a few days you will have a clear picture of the risks and a proposed solution with pricing.
Frequently asked questions
How much does business backup cost?
The price depends on the amount of data, the number of servers and workstations, and the recovery objectives (RTO and RPO). It is billed as a monthly service that includes licenses, cloud storage, monitoring and testing, so there is no large upfront investment. For a smaller company with one server, the amount is comparable to other regular IT costs; we provide an exact quote after a free assessment.
How often are backups performed?
The standard is at least once a day, outside working hours. For critical systems such as the ERP and databases, copies are made more frequently, every 15 minutes to every hour, depending on the agreed RPO. Microsoft 365 data is backed up several times a day. Frequency is defined per system, so the most important data has the smallest possible loss window.
Where is the backup data stored?
The primary copy stays on your premises for fast restores, while the second copy goes offsite: to a certified data center in the EU (cloud backup) or to your second business location. All copies are encrypted with AES-256, and the offsite copy is kept in an immutable form that not even an attacker with administrator privileges can delete. This also covers the GDPR requirement for protecting personal data.
How quickly can we recover after an incident?
Individual files and folders are restored within minutes. Restoring an entire server takes from half an hour to several hours, depending on the amount of data and the technology. Recovery time is not a matter of luck but a contracted objective (RTO) that is defined per system and verified through test restores, so you know in advance how long recovery will take.
Is the backup tested regularly?
Yes, and that is the most important difference between a backup that exists and a backup that works. Every backup job is checked automatically every day, and we periodically perform test restores of files, servers and databases, delivering a short report on the results. Veeam environments additionally use automated verification that boots the copy in an isolated environment and confirms that the system can actually be started from it.