Backup & recovery.
A backup that has never been restored is a hope. We back up 3-2-1 with an immutable copy, back up Microsoft 365 separately — and restore regularly, with a log.
- 3-2-1: three copies, two media, one off-site
- At least one copy immutable — against ransomware and operator error
- Microsoft 365 is backed up separately; built-in retention is not a backup
- RPO and RTO agreed per client per system
- Restore tests regularly, logged with date, duration, result
Backup & recovery
Servers — virtual and physical —, databases, file servers, Microsoft 365 (Exchange, SharePoint, OneDrive, Teams), firewall and switch configurations. Workplaces only if data lives there; our standard is that it lives centrally. For each system we define how much data loss (RPO) and downtime (RTO) is acceptable — frequency and recovery path follow from that.
Restore log
Every test is logged — including the ones that did not work at first. The log is the evidence cyber insurers now want to see.
- Date and time
- System and scope (file / VM / mailbox / scenario)
- Backup point used
- Time until available
- Result and deviations
- Actions, if needed
Backup & recovery — the parameters.
Values set per client are marked "agreed per client".
Servers and file servers typically daily, databases more often if needed, Microsoft 365 several times a day. Exact values follow from RPO/RTO and are agreed.
Daily points for a period of weeks, monthly points longer; statutory retention periods are taken into account. Duration agreed per client.
At least one copy with object lock or a hardened repository: cannot be deleted or encrypted within the period — not even with admin rights.
Off-site copy in a data centre in Germany or the EU; for Microsoft 365 in the backup vendor's EU data centre.
Backup credentials are separate accounts with MFA, distinct from domain and tenant admins. Whoever compromises production does not get the backup.
Regular spot checks (file, mailbox, single VM) and at longer intervals a full scenario (booting a system from backup). Cadence agreed per client.
In transit and at rest; keys documented and stored separately — a backup whose key nobody can find is not a backup.
With what — and what is replaceable.
| Tool | Role | Data location | Replaceable by |
|---|---|---|---|
| Veeam | Backup of VMware and Windows environments, hardened repository | your site + off-site copy EU | any product with an immutable target and restore testing |
| Proxmox Backup Server | Backup of Proxmox environments, deduplication, verification | your site + off-site copy EU | open source |
| Microsoft-365-Backup (EU-Anbieter) | Mailboxes, SharePoint, OneDrive, Teams — own retention, independent of Microsoft | vendor EU data centre | any M365 backup with export |
| RMM-Plattform | Monitoring of backup jobs, alert on failure | EU instance | — |
What we deliberately do not do
- No backup without a restore test — a backup that has never been verified does not count as existing for us
- No backup reachable with domain admin rights
- No "Microsoft takes care of that" — retention policies are not a backup
- No copy outside the EU without your explicit decision
Prerequisites on your side
- Inventory of systems with RPO/RTO rating (we do this in the assessment)
- Local storage target and access to the off-site target
- Decision on retention
- A window for restore tests in which a test system may run
Questions from IT
Why back up Microsoft 365 separately — it is already in the cloud?
Because Microsoft guarantees availability, not recovery. Deleted or encrypted data is gone once retention expires, and a ransomware attack on accounts dutifully syncs into the cloud. A separate backup with its own retention is the only way back.
How long does a recovery take?
A file: minutes. A mailbox: under an hour. A complete VM: depending on size and target, typically hours. The RTO we agree is the time we trust ourselves with — and prove in the restore test.
Where are the copies physically?
One locally at your site (fast recovery), one off-site in a data centre in Germany or the EU (immutable), for Microsoft 365 in the backup vendor's EU data centre. Locations are in the documentation.
Does the backup really help against ransomware?
Only if it survives the encryption and is older than the infection. Hence: immutable copy, separate credentials, retention over weeks — and a restore test that shows the way back works before you need it.
Let's talk about your IT.
An intro call is free and non-binding. We listen, we ask — and we'll say openly whether we're the right people for you.