In short
A backup is a copy of your data that the business can be restored from. What matters is not that it runs but that the restore works and how long it takes. A backup that has never been restored is an assumption, not protection.
The rule that has stuck
Three copies, two different media, one off site — and in the current version, one of them not overwritable. That last addition came out of experience with encryption attacks: they look for the backup first and encrypt it too.
A backup to a permanently connected drive or network share does not meet that condition. It sits inside the same access as the data it is supposed to protect.
Two numbers every business should know
How much work can you afford to lose? With a nightly backup at 02:00 the answer is up to one working day. How long may a restore take? With a cloud-only backup, several terabytes is a question of days, not hours.
Both are business decisions, not technical ones. They determine what the backup is allowed to cost — and without them you buy either too much or the wrong thing.
Microsoft 365 is not backed up
The most common misconception in Swiss SMEs. Microsoft guarantees the availability of the service, not the recovery of your content. Deleted mail and files are gone once the recycle-bin retention expires.
Running mail, SharePoint and Teams without additional backup means you do not have a backup for that data — you have a retention period.
How we handle it
We set up backups so one copy sits outside an attacker's reach, and we test the restore rather than read the log. A green log says something was written. It does not say it can be read back.
How we work: backup and cloud. The connection to encryption attacks is under ransomware.
Related terms
A term in your quote that nobody explained?
In a strategy call we translate the offer in front of you — even when it did not come from us.