Cloud backup for businesses: Securely back up data off-site

Cloud backup means storing backup copies of company data not on local hard drives or tapes, but automatically transferring them to an external data center.

The crucial advantage lies in the physical separation. A backup located in the same server room as the original will not survive fire, water damage, or theft — and in many cases, it won't even survive ransomware attacks, because modern malware specifically targets accessible backup drives.

This article explains how cloud backup differs from synchronization and archiving, how it protects against ransomware, which systems should be backed up, what to consider when choosing a provider and regarding data protection—and why a backup without tested recovery is of little value.

Table of contents

• What cloud backup is – and what it isn’t
• Cloud, local or hybrid: which model fits when
• Ransomware protection: immutable backups
• Which systems need to be secured
• Setting up cloud backup: step by step
• Choice of provider, data protection and costs
• Conclusion
• FAQ about cloud backup

What Cloud Backup is – and what it isn't

A cloud backup is an automated, versioned backup stored on an external server, from which a defined previous state can be restored.

Three terms are frequently confused, even though they serve completely different purposes:

The middle point is the most dangerous misconception. Cloud storage like OneDrive or a network drive is not a backup. If a file is accidentally deleted or encrypted by malware, synchronization reliably transfers this change to the cloud. Without true versioning, the original is then lost there as well.

The distinction between backup and archiving is discussed in more detail in the article on email archiving: A backup serves for recovery, an archive for documentation.

What security actually depends on

A cloud storage destination doesn't automatically provide protection. Four points are crucial:

• Encryption during transmission and storage
• Separate access: The login for backups must be different from the login for daily operations
• Immutable retention, so backups cannot be deleted for a defined period
• Logging, so deletions and accesses remain traceable

The second point is most often overlooked. Anyone who can log in to the backup with the regular administrator account gives an attacker who takes over that account access to both production data and the backup simultaneously.

Cloud, on-premises or hybrid: which model is right when?

For most SMEs, a hybrid approach is the most practical: a local backup for quick recovery in everyday operations—for example, an accidentally deleted file or a faulty update—combined with a cloud copy as protection against on-site data breaches and attacks.

A simple guideline is the 3-2-1 rule: Companies should have at least three copies of important data, store them on two different storage devices, and keep one copy off-site. Cloud backup primarily fulfills the last point: It creates an external backup that is not affected by the same on-site data breaches as the production data.

Often, it's not about replacing an existing solution, but rather about supplementing it: The existing local backup remains, and a second copy is moved off-site. This is usually the fastest way to achieve a noticeable increase in security because existing processes remain unaffected.

A special case is cloud-to-cloud backup. It backs up data that is already in the cloud to a second, independent location. This is particularly relevant for Microsoft 365: The provider is responsible for operating its platform, but not for restoring your content after accidental deletion or an attack. The article on Microsoft 365 backup explains why this requires a separate backup solution.

The article on cloud strategy discusses how this fits into a broader policy decision.

Protection against ransomware: immutable backups

Encryption Trojans have adapted their approach. They do not encrypt immediately, but often remain unnoticed in the network for weeks - and during this time they specifically search for accessible backups in order to delete them or encrypt them.

This results in three requirements for a backup that can be used in an emergency:

1. immutable storage. Once backups have been written, they cannot be deleted or changed for a set period of time - even with administrator rights. This is the single most effective measure because it works even when attackers have full control of the environment.
2. sufficiently long storage. If an attack is only noticed after three weeks, backups from the last seven days are of no use - they already contain the malware. The retention period must be longer than the realistic time until discovery.
3. Separate entrances with multi-factor registration. The backup account should exist solely for this purpose and require a second factor in addition to the password login. The article on multifactor authentication describes how this can be implemented.

In addition, the end devices need protection that detects suspicious behavior early - see Endpoint Security. The earlier an attack is noticed, the shorter the time period in which you have to jump back.

For small and medium-sized companies without their own IT department, the hurdle is rarely the technology, but rather the reliable operation: Does the backup really run every night? Does anyone see the error messages? FIGULI CONSULTING sets up cloud backup for Austrian SMEs, monitors the backup runs and checks at fixed intervals whether the data can actually be retrieved.

Check backup concept with FIGULI

Which systems need to be secured?

The selection isn't based on the amount of data, but rather on the question: Without which data does the business grind to a halt?

Typically, this includes:

• File servers and network storage containing the current workspace
• Virtual machines and their configurations, enabling the restoration of entire systems
• Databases for inventory management, accounting, and industry-specific software
• Microsoft 365 with mailboxes, files, and Teams content
• Firewall, network, and server configurations
• Laptops belonging to people who frequently work remotely

The last two points are most often overlooked. A firewall configuration is small, but reconstructing it after a failure can take days. And laptops regularly contain files that were never stored on a server.

How often should backups be performed

The frequency of backups stems from a simple question: How many hours of work could we reasonably afford to redo?

If a single overnight backup is considered acceptable, a daily backup is sufficient. For inventory management or accounting, where entries are made continuously, multiple backups per day are advisable. Equally important is the counter-question: How long can the recovery process take? A server that is essential for operations requires a faster backup method than an archive drive.

These two values—acceptable data loss and acceptable downtime, often referred to as RPO and RTO—determine the technology and costs more than any other factor. They should be defined for each system and documented.

Setting up cloud backup: step by step

1. Inventory: Which systems and data sources exist, and which are business-critical?
2. Define objectives: acceptable data loss and downtime for each system
3. Choose a model: pure cloud or hybrid, depending on data volume and connectivity
4. Check providers: data location, immutable storage, recovery options
5. Perform initial backup – for large data volumes, factor in the duration of the first transfer
6. Separate access: separate backup account with two-factor authentication
7. Set up monitoring: Who receives notifications of failed backups?
8. Document the process: In an emergency, who restores what, and in what order?
9. Test the recovery – and repeat the test.

Why the restore test is the most important step

A backup that has never been restored is an assumption, not a backup.

In practice, restores rarely fail because there is no data available. More often, the reasons are: A critical system was never included in the backup job. The backup process has been running for months without anyone reading the error messages. The restore takes three times longer than expected. Or no one knows the correct order in which systems need to be restored.

A sensible testing schedule: a single file monthly, a complete system annually – with a log of the duration and results. Comparing the actual duration with the planned target time is the real key to gaining valuable insights.

Provider selection, data protection and costs

What to consider when choosing a provider

Storage price is the weakest selection criterion. More important are:

• Data location: In which country is the data stored, and is this contractually guaranteed?
• Immutable storage as an actual, available feature, not as an optional extra.
• Recovery options: individual files as well as entire systems.
• Recovery costs: Some providers charge separately for downloads – precisely when you urgently need them.
• Emergency availability, including response times.
• Logging of access and deletions.

The fourth point deserves special attention. With very cheap storage offers, the costs often lie in the retrieval. In the event of a major data recovery, this can become significant.

Data protection

When using an external provider, a data processing agreement in accordance with the GDPR is required. This also includes a data deletion and retention policy, transparent logging, and clarification of the data location.

The Austrian Federal Economic Chamber's guide offers practical guidance on technical and organizational measures. Digital Austria provides an overview of Austrian digitalization and cloud initiatives.

Cost

The costs are comprised of storage volume, the number of backed-up systems, the retention period, any retrieval fees, and the effort required for setup and ongoing monitoring.

The biggest cost driver is usually the retention period, not the amount of data. One year of retention costs many times more than four weeks. This is precisely where a deliberate decision is worthwhile, rather than a one-size-fits-all approach: Not all systems require the same retention period.

Conclusion

Cloud backup protects against precisely those scenarios that local backups are powerless against: fire, water damage, theft, and ransomware that compromises accessible backup drives.

For it to be effective in a crisis, four things are crucial: immutable backups, a retention period longer than the time it takes to detect an attack, separate access with two-factor authentication, and regularly tested recovery procedures.

The most common mistake isn't the wrong technology, but rather the untested assumption. Almost every company has a backup. Far fewer have checked in the last twelve months whether data can actually be recovered from it.

FIGULI CONSULTING helps Austrian SMEs establish cloud backup as a reliable operational process: with a suitable backup strategy, separate access, ongoing monitoring, restore tests, and clear recovery planning. Furthermore, FIGULI is a partner for related IT topics such as Microsoft 365, IT security, endpoint security, and ongoing IT support.

Implementing Cloud Backup & IT Security with FIGULI

FAQ about Cloud Backup

What is a cloud backup?

A cloud backup is an automated, versioned backup of company data stored in an external data center. It allows you to restore a previous state after data loss, user error, or an attack, and is physically separate from the original.

Is cloud storage like OneDrive a backup?

No. Cloud storage synchronizes data between devices, including deletions and encryptions. Without true versioning and a controlled recovery process, this is not a backup, but rather synchronization.

How does a cloud backup protect against ransomware?

Crucial factors are immutable backups that cannot be deleted for a defined period, even with administrator privileges, a sufficiently long retention period, and separate backup access with two-factor authentication. This ensures that a state before encryption remains accessible.

How often should data be backed up?

The frequency depends on how much work could be repeated in a worst-case scenario. For many areas, a daily backup is sufficient. Systems with ongoing transactions, such as inventory management or accounting, usually require several backups per day.

Which systems should be backed up?

File servers, virtual machines, databases of specialist and accounting software, and Microsoft 365 data. Firewall and network configurations, as well as laptops used by people who travel frequently, are often overlooked.

How do I check if my backup is working?

Through scheduled restore tests: a single file monthly, a complete system annually. Document the duration and results, and compare the actual duration with the target. Successful backup notifications alone are not sufficient proof.

What should be considered regarding data protection?

A data processing agreement with the provider, a deletion and retention policy, traceable logging, and clarity regarding data location are essential. The location should be contractually guaranteed, not just advertised.

How much does cloud backup cost?

The costs depend primarily on storage volume, the number of systems backed up, the retention period, recovery options, and ongoing monitoring. Potential retrieval costs in an emergency are particularly important. Compare not only the storage price but also restore speed, data location, and support.