Microsoft backs it up, and other backup myths that leave small offices exposed

Not in the way most people think

Microsoft 365 and Google Workspace are built to keep the service running, and they let you recover recently deleted items for a limited time, but they are not a full backup of your business data. They do not fully protect you from a deletion nobody notices for months, ransomware that encrypts files and syncs them to the cloud, or an attacker who gets administrator access and deletes everything. A real backup is a separate copy outside the platform, at least one copy that cannot be changed or deleted from your network, and restores that someone has actually tested.

I am Anthony Omini, owner of Cross River Tech in Dallas. Backups are the part of IT that every small office believes is handled and that I most often find is not. This guide walks through the myths I correct most often, because each one feels reasonable right up until the day it costs someone their files.

Myth: our files are in the cloud, so they are backed up

Availability and backup are different promises. The cloud platform's job is to make sure your mailbox and files are there when you sign in. If a person in your office deletes a client folder, the platform faithfully deletes it. If ransomware encrypts files on a laptop that syncs to OneDrive or Google Drive, the encrypted versions sync too. If an attacker takes over an administrator account, they have the same power to delete that you do. Recycle bins and version history help, but they have time limits and they sit inside the same account the attacker controls.

That is why we back up Microsoft 365 and Google Workspace with a separate service outside the tenant, several times a day. It is a small cost compared with the alternative, and it is one of the first gaps I check for when we take over an office.

Myth: the software says the backup succeeded

A green check mark means the job ran. It does not mean the right data was copied, or that it can be restored. Our own site describes a case of backup jobs reporting success for a year while backing up an empty folder. A backup can also skip a database because a file was open, quietly stop including a newly added server, or depend on an encryption key nobody can find when it is needed.

The only proof is a restore. CISA's ransomware guidance tells organizations to regularly test the availability and integrity of backups in a disaster recovery scenario, and that is exactly the right standard. Our restore tests run on a schedule: a few files from last week, a mailbox from last month, and periodically a full server restore to a spare machine or cloud instance, checked by opening the business software. Each test produces a short note for the client saying what was restored and how long it took.

Myth: the external drive on the server is our backup

An external drive that stays plugged into the server, or a network folder every computer can reach, is better than nothing and far worse than most owners assume. Ransomware looks for exactly those copies, and anything the infected computer can write to, it can encrypt. A fire, a burst pipe or a theft takes the server and the drive together.

CISA's guidance is to maintain offline, encrypted backups of critical data, because attackers deliberately go after the backups they can reach. In practice, that means backups kept in more than one place, with at least one copy that cannot be changed or deleted from your network and an encrypted offsite copy kept separate from the office's everyday passwords. Syncing tools like OneDrive or Dropbox are useful for working, but they copy mistakes and infections just as faithfully as good files, so they do not count.

Myth: we are too small to be a target

Most attacks are not aimed at a particular company. They are automated, sent to thousands of addresses and run against any system with a weakness. The FTC's small business guidance opens with the point that cyber criminals target companies of all sizes. A small office with client files, patient records or banking access is a reasonable target precisely because it is less likely to have a tested backup.

Ransomware is not the only threat, either. Many restores are for ordinary accidents: an overwritten spreadsheet, a deleted folder, a laptop left in a car, a server drive that failed. A good backup is as much about Tuesday-afternoon mistakes as it is about criminals. And a hacked mailbox often ends with deleted mail the attacker did not want you to see, which is one more reason to read the warning signs of a compromised business email account.

Myth: if something goes wrong, we will just restore it

Restoring a few files takes minutes. Restoring a whole server from an offsite copy can take far longer, depending on how much data there is and how fast the connection is, and in the meantime the office may not be able to work. The question to ask is not whether you can restore, but how long the office can afford to be down and how much recent work it can afford to lose.

Ready.gov's guidance for IT disaster recovery says the recovery time for an IT resource should match the recovery time objective of the business function that depends on it. In plain terms, decide how long you can be without each system, then build the backup to meet that. For a server, that is why we keep a local backup appliance for fast restores alongside the offsite copy: if the server fails, the office can run from the appliance the same day while the server is repaired.

Myth: once it is set up, it is done

Backups drift. A new computer joins the office and nobody adds it. The practice software moves its database to a new folder. A new partner keeps files on her desktop instead of the shared drive. Retention settings that made sense for a design firm are too short for a medical practice that has to keep records for years. None of this triggers an error message.

That is why backup is ongoing work rather than a product you buy once. Every change to the office should raise the question of whether the backup still covers it, and someone should be looking at the results every day, not only when something breaks.

A simple habit helps here. Whenever the office adds a computer, a server, a new piece of software or a new person, add one line to the checklist: confirm the backup now includes it. When someone leaves, decide how long their mailbox and files should be kept before the account is removed. Those two moments, arrivals and departures, are where most gaps begin, and both are easy to catch if someone is asking the question every time.

What a backup setup that works looks like

Every office is a little different, but this is the shape of what we put in place for managed clients. If your current setup is missing more than one of these, it is worth a closer look.

• Servers: a local appliance for fast restores plus an encrypted offsite copy, with business databases backed up several times a day and the whole server nightly
• Workstations: key folders synced to the cloud continuously, and nightly image backups for critical machines
• Microsoft 365 or Google Workspace: a separate backup outside the tenant, several times a day
• Network equipment: configuration exported and stored after every change
• Retention set by business type, so records are kept as long as the office needs them
• Scheduled restore tests with a written note each time, and a written recovery plan reviewed once a year

Five questions to ask about your backup this week

You do not need to be technical to find out where you stand. Ask whoever handles your IT these five questions and write down the answers. Vague answers are an answer too.

If the person you ask cannot answer the second question with a date and a description of what was restored, treat the backup as untested until someone proves otherwise.

• When was the last successful backup of each server, and of email?
• When did someone last restore a file from it, and what was restored?
• Where is the offsite copy, and could someone with our passwords delete it?
• Is Microsoft 365 or Google Workspace backed up outside the platform?
• If the server died this morning, how long until we could work again?

Turning a hopeful backup into a tested one

If the answers worried you, the fix is usually less dramatic than people expect. We start with an assessment of every computer, server, mailbox and backup, then fix the gaps in order of risk and finish with a restore test before calling the work done. The tested backup and recovery plan also give you something concrete to show an insurer, which matters at renewal time; my guide to the IT questions on a cyber insurance application explains why. Backups also cover the physical side of risk, from storms to outages, which I cover in keeping office IT running through Texas storms and power outages.

Backup and recovery are included in our managed plans across Dallas–Fort Worth, and a standalone backup setup or a one-time review can be quoted as a fixed project or done at our published hourly rate. Either way, the goal is the same: a backup you have watched restore, not one you hope will.

Questions people ask me