Is your backup strategy ready for next year?

Are all business-critical systems backed up?

• Servers
• Virtual machines
• Cloud data (Microsoft 365, SaaS)
• Databases
• File servers

Are remote sites and home office devices also covered?

Is there up-to-date documentation of all backup jobs?

Warning: Systems have been added during the year but never included in the backup.

Does the backup frequency meet your business needs?

Have you defined your RPO/RTO targets?

Are backups immutable or protected against tampering?

Are the identities of your M365 backups protected?

Are there air-gapped or isolated backups?

Do backup systems have separate administrator accounts?

Warning: The backup system and production environment use the same administrator accounts.

Backups are only as good as the recovery process.

Has a restore test been carried out in the last 6 months?

Have the following scenarios been tested?

• Restoring a single file
• Restoring a complete VM
• Disaster recovery

Do you know your recovery time?

Is there a second copy stored off-site?

Are backups protected against the following risks?

• Fire
• Power failure
• Natural disasters
• Ransomware

Many companies follow the 3-2-1-1-0 rule:

• 3 copies of the data
• 2 different storage media
• 1 off-site copy
• 1 immutable backup
• 0 errors after recovery testing

Are backup jobs monitored automatically?

Are errors reported immediately?

Does anyone check the reports regularly?

Warning: Failed backups are only discovered weeks later.

Is there enough backup storage for the coming year?

Has data growth been taken into account?

Is there an archiving strategy for old data?

Are statutory retention periods being adhered to?

Are backups stored in an audit-proof manner?

Are there clear deletion policies in place?