Backups: why the cloud isn't a backup yet

Why it matters

A typical situation that every IT company sees. On Monday morning the files won’t open, their names have changed, and every folder holds a text file with a ransom demand.

The first question is always the same: “But isn’t everything in the cloud?”

Yes. And that’s exactly why everything is encrypted — not only on the computer, but in the cloud and on your colleagues’ computers too. This lesson is about why that happens and what to do this week so that, on a morning like that, the company is back on its feet in a few hours, not a few weeks.

Sync is not a backup

OneDrive, SharePoint and Google Drive sync: whatever changes in one place appears everywhere else. That’s very convenient — as long as the change is a good one.

What happens in a few minutes

💻Your computera virus encrypts the files

encrypted files

☁️OneDrive / SharePointsyncs the change

the same files

👥Colleagues' computersget the “latest version”

Damaged everywhere the file is synced. Sync did its job — precisely.

A separate backup doesn't see this: it is made and stored separately, not synced.

A backup works the other way round: it doesn’t record every change in real time. Instead, every so often it makes a separate copy and keeps it. That’s why you can go back from it to yesterday, last week or last month.

What Microsoft 365 keeps by itself — and for how long

Microsoft 365 has good recovery tools. The trouble is that all of them work for a limited time and inside the same account.

• Recycle bin (SharePoint and OneDrive): deleted files are kept for 93 days from deletion. This period can’t be changed.
• Version history: you can go back to an earlier version of the same file.
• Restore your OneDrive: if a lot of files have been encrypted or deleted, the whole OneDrive can be rolled back to any moment in the last 30 days.
• A departed employee’s OneDrive: kept for 30 days by default; for 93 days after that, only an administrator can restore it.

What will save you

What happened	Microsoft recycle bin and versions	Separate backup
File deleted a week ago	✓	✓
Deleted 4 months ago	✗	✓
All files encrypted, noticed within a week	✓	✓
A departed employee's OneDrive after six months	✗	✓
An attacker deletes everything, recycle bins included	✗	✓

So Microsoft’s tools are great for everyday mistakes. A separate backup is needed for what’s noticed too late, and for what destroys the account itself.

The 3-2-1 rule

Older than the cloud and still true. Today it’s usually written with two additions:

3-2-1, or better still 3-2-1-1-0

1. 3 copiesthe working data plus two more copies
2. 2 different mediae.g. the cloud and a separate backup system
3. 1 elsewherenot in the same office and not in the same account
4. +1 unchangeablenot even an administrator can delete it
5. 0 errorsthe restore test succeeded

Two questions that decide everything

Before choosing any solution, answer two questions for yourself. In plain words:

1. How much work can we afford to lose? If the backup runs every night, in the worst case you’ll lose one day’s work. Is that acceptable for accounting at the end of the month?
2. How long can we afford to stop working? Restoring one file takes minutes. A whole server or every employee’s email can take hours or days.

IT people call these RPO and RTO. For you, answers in hours are enough — they decide what kind of backups you need and how much they cost.

A plan in 20 minutes — drawn up by AI

You know where your company’s data lives. The AI knows how to turn that into a plan. Copy this, fill in the square brackets and paste it in:

You are my IT adviser. Help me draw up a backup plan for my company —
short, one page, that someone outside IT would understand.

ABOUT US
- Business and number of employees: [...]
- Where we keep data: [e.g. Microsoft 365 email and files, accounting
  software, a server in the office, the website, employees' computers]
- What we do for backups now: [nothing / don't know / ...]

PROCESS
1. ASK. Ask me the missing questions, one at a time. Be sure to ask how much
   work we can afford to lose and how long we can afford to stop working — for
   each system separately.
2. PLAN. As a table: system → what is backed up → how often → where it's
   stored → how long it's kept → who is responsible. Mark where we don't
   follow the 3-2-1 rule.
3. RESTORE TEST. Suggest a first test I can do this week, and walk me
   through it step by step.

GOAL
The job is finished when I have a one-page plan and one successful restore
test — not when I have a list of tips.

RULES
- Never ask for administrator passwords or login codes.
- Don't delete or change anything in my systems — only suggest and explain.
- Don't make up prices or product features. If you suggest a specific
  solution, tell me what I need to check myself.
- Answer in English.

AT THE END
Write what we discussed and, separately — WHAT YOU DID NOT CHECK.

It’s better to answer the “how much can we afford to lose” questions together with your accountant or a manager, not alone. They’re the ones who know which day of the month is the most expensive.

The restore test — the only real check

A backup you’ve never restored from is only a hope. Start with the smallest test — one file from last week.

Once one file has worked, try a whole folder next month. After that — a restore from the separate backup system, if you have one. Write down the time on each occasion.

What to do this week

1. Copy the prompt above and draw up the plan with AI in 20 minutes.
2. Do your first restore test — one file — and write down the time.
3. Check that you have at least one backup that isn’t in the same Microsoft 365 account. If not, that’s your first purchase, not your last.

If you need someone else to plan and look after your backups — pagalba@itbroliai.lt.

Check yourself

Five questions on what you’ve just read. At the end you’ll get a certificate with your score.