Business Backup Strategy That Actually Restores

RAID and OneDrive sync are not backups. How to design your copies, protect them from ransomware and prove they restore.

Quick answer

A business backup strategy that actually restores keeps at least three copies of your data: the live system, a local NAS backup with snapshots for fast recovery, and an encrypted off-site copy that ransomware cannot alter. Microsoft 365 or Google Workspace is backed up separately. Most importantly, someone restores real data on a schedule, times it and records the result.

Key takeaways

RAID keeps a system running when a disk fails and sync keeps files in step, but neither is a backup.
Set a recovery point objective and recovery time objective for each system, then design backups around them.
Follow 3-2-1-1-0: three copies, two types of storage, one off-site, one immutable or offline, zero errors after verification.
Back up Microsoft 365 or Google Workspace separately; recycle bins are not a backup.
Test restores at single-file, folder and whole-system level, time them and record the results.

Why does a backup that reports success still fail?

Because a green tick proves the job ran, not that the data comes back. Ask most offices whether they have a backup and the answer is yes. Ask when they last restored a file from it, and the room goes quiet.

Backup software can report success every night while skipping a moved folder, a locked database or a mailbox never added to the job. The gap shows on the day a drive fails or ransomware hits. The useful question is not whether you have a backup, but how long until the office is working again, and whether anyone has proven the answer. CISA publishes a practical checklist for preparing for and recovering from an attack in the #StopRansomware Guide.

Is RAID or OneDrive sync a backup?

No. RAID and sync keep data available, but neither keeps a separate, older copy you can go back to, which is the whole point of a backup. Synology explains plainly what RAID does and does not protect against in its guide to RAID.

RAID protects against a failed disk, nothing more

RAID spreads data across several disks so the NAS or server keeps running when one dies. It faithfully applies every deletion, corruption and ransomware encryption to every disk. If the whole unit fails, is stolen or overheats in the rack room, the RAID set goes with it.

Sync copies mistakes as quickly as it copies work

OneDrive, SharePoint and Google Drive keep the same files on every device, so a deletion or an encrypted file also spreads everywhere within minutes. Version history and recycle bins help, but they sit inside the same account, follow retention limits you do not fully control, and can disappear with the account.

How do you decide RPO and RTO for each system?

Ask two questions per system: how much recent work could we afford to redo, and how long can we manage without it? The first answer is your recovery point objective (RPO); the second is your recovery time objective (RTO).

RPO sets how often backups run. If losing an afternoon of accounting entries is unacceptable, a nightly backup is not enough for that system. RTO sets where the copy lives. Pulling a large file share back from the cloud over a du or e& business line takes far longer than restoring it from a NAS in the same office. Agree both with the people who run the business, not only IT. A practical starting point: Choosing and configuring the unit itself is covered in our guide to Synology and QNAP NAS setup.

Accounting and line-of-business databases: short RPO and a fast local restore.
Shared files: snapshots during the working day plus a daily off-site copy.
Email and cloud files: daily backup through a cloud-to-cloud service.
Firewall, switch and NAS configurations: exported after every change.

What is the 3-2-1 backup rule, and what does 3-2-1-1-0 add?

The 3-2-1 rule means three copies of your data, on two different types of storage, with one copy off-site. The 3-2-1-1-0 extension adds one copy that is immutable or offline, and zero errors when backups are verified. The table shows how that maps onto a typical office. What a managed backup service covers is on our business backup services page.

A practical 3-2-1-1-0 layout for an office
Copy	Where it lives	Protects against
Local snapshots and backup	NAS in the office, separate from the main server	Accidental deletion, overwritten files, a failed server
Encrypted off-site copy	Cloud backup storage or a NAS at a second location	Fire, theft, water damage, loss of building access
Immutable or offline copy	Locked cloud storage, immutable snapshots or disconnected media	Ransomware or an attacker deleting backups
Cloud-to-cloud backup	Separate service for Microsoft 365 or Google Workspace	Deleted mailboxes, removed users, retention limits

Local NAS with snapshots for fast restores

A business NAS from Synology or QNAP can take scheduled snapshots of shared folders several times a day and roll back a single file or a whole share over the office network. Snapshots live on the same device, so pair them with a backup job to a second destination. Put the NAS on a UPS with proper cooling; a rack room in a Dubai summer is hard on disks.

Encrypted off-site copy

Encrypt the off-site copy before it leaves the office and record where the key is kept, outside the NAS. Lose the key and the backup is unreadable. Check the first full upload is realistic for your internet line, and schedule uploads outside office hours.

How do you protect backups from ransomware?

Keep at least one copy that cannot be changed or deleted for a set period, and manage backups with accounts separate from everyday admin logins.

Attackers look for backups first. If the backup is a share mapped on a staff PC, or the console uses the same admin password as everything else, it can be wiped before the live data is touched. Backups are one layer of a wider plan covered in our guide to cybersecurity for small businesses in Dubai.

Turn on object lock in cloud storage or immutable snapshots on the NAS, with retention longer than an attack could go unnoticed.
Use dedicated backup credentials that are never used for daily work.
Protect the backup portal and NAS admin login with multi-factor authentication.
Never map backup destinations as drives on user computers, or expose the NAS management page to the internet.

What should be backed up in a small business office?

Everything you would need to rebuild the business on new hardware, not only the shared drive. The items most often missed are cloud mailboxes, application databases and device configurations.

File shares, including any created after the backup job was set up
Microsoft 365 or Google Workspace mailboxes, OneDrive or Drive files, SharePoint and Teams data
Accounting, ERP or CRM databases, using the vendor's supported backup method so the copy is consistent
Laptops, or a policy that keeps work files in backed-up locations rather than on the local disk
Firewall, switch, Wi-Fi and NAS configuration exports, licence keys and admin account records

Why Microsoft 365 and Google Workspace need their own backup

Both providers describe a shared responsibility model: they keep the service running, while the customer remains responsible for its own data. Recycle bins only keep deleted items for a limited time, and a mailbox is eventually removed after a user's licence is taken away. A cloud-to-cloud backup keeps independent copies with retention you set. If you are changing platforms, build it into your Microsoft 365 migration plan.

Retention and versioning

Keep frequent restore points for recent days, then fewer weekly and monthly points, so a file corrupted weeks ago can still be recovered. Where contracts or rules such as UAE Federal Decree-Law No. 45 of 2021 apply, confirm retention periods with your legal adviser.

How do you test a restore and record the result?

Restore real data to a safe location, time it, confirm it opens and write the result down. A full test every six months is a sensible minimum, with quick single-file checks more often.

Run three levels of test

Single file: restore last week's document to a test folder and open it.
Full folder: restore a departmental share from the off-site copy and compare file counts and sizes with the original.
Whole system: rebuild a server or accounting database in a test environment and have a user check recent entries.

What to record

Log the date, who ran the test, which copy and restore point were used, start and finish times, whether the data was complete, and any fixes needed. Compare the time with the agreed RTO; if the business cannot wait that long, fix the design now, not during an outage. This log, each system's RPO and RTO, and a list of who does what form the core of your disaster recovery plan.

Why do backups fail without anyone noticing?

Usually something changed and nobody was watching the alerts. Send failures, missed schedules, low storage and disk warnings to a named person, and treat a job that has not reported at all as failed. Common causes:

Full disks: storage fills up, so jobs fail or old restore points are pruned early.
Expired credentials: a changed password, expired token or lapsed cloud subscription stops the job.
Excluded folders: a new share or database is simply not in the backup selection.
Alerts going nowhere: failure emails sent to a former employee or an unread mailbox.
Untested restores: the job runs, but nobody has proven the data comes back or how long it takes.

How do you back up laptops for staff who are rarely in the office?

A growing share of Dubai businesses have people who work from client sites, from home, or from a different emirate most of the week, and their laptops hold work that never touches a server. The office backup, however good, does not see it. This is the gap most often discovered when a laptop is stolen from a car or dies in the heat of a parked vehicle in July.

The first move is to stop the important data living only on the laptop. Redirecting the Desktop, Documents and Pictures folders into OneDrive means everything a person saves in the usual places is synced to the cloud within minutes, wherever they are, without them changing a habit. That is protection against a lost or dead device, and it is included in the Microsoft 365 licences most offices already pay for. It is not a backup on its own, because a deletion or an encryption syncs just as faithfully, so it sits alongside the separate Microsoft 365 backup rather than replacing it. Microsoft offers its own paid retention product, Microsoft 365 Backup, which is separate from the recycle bins included in your licence.

For laptops that carry things OneDrive does not cover, such as local application data, a design tool's working files or a finance system's local database, an endpoint backup agent that runs quietly in the background and uploads changes whenever there is a connection is the right tool. Encrypt the laptop itself so the data is useless to whoever picks it up, keep the agent's schedule generous on bandwidth so it does not fight with video calls on hotel Wi-Fi, and check the console monthly for the laptop that has not reported in three weeks. That one is either sitting in a drawer or is the problem you have not heard about yet.

Redirect the standard folders into OneDrive so daily work is synced without changing habits.
Add an endpoint backup agent for anything that lives outside those folders.
Encrypt every laptop, so a lost device is a hardware loss and not a data loss.
Review the backup console monthly for devices that have gone quiet.
Include leavers' laptops: the backup is preserved before the device is wiped and reissued.

How Listonics helps with a business backup strategy

Listonics designs, installs and supports NAS storage and backup for Dubai offices of roughly 5 to 200 staff. We start with a free office IT assessment to map what data you hold, where it lives and the recovery objectives each system needs. We then set up Synology or QNAP storage with snapshots, encrypted off-site copies, immutable restore points and separate backup credentials, alongside backup for Microsoft 365. Projects are quoted as fixed-scope, itemised proposals. Under a managed IT support plan, backup jobs are covered by 24/7 monitoring, so failures are picked up rather than discovered on the day you need a restore. To review your current setup, contact our team to arrange a site survey.

Frequently asked questions

Keep three copies of your data, on two different types of storage, with one copy off-site. For most offices that means the live data, a local NAS backup and an encrypted cloud copy. The 3-2-1-1-0 version adds one immutable or offline copy and zero errors when backups are verified.

Set the frequency by how much work each system could afford to redo. Business files and Microsoft 365 data should be backed up at least daily, with NAS snapshots several times a day for busy shares. Databases that change constantly may need more frequent backups using the application's own method.

Yes, if the backup sits on a network share the malware can reach, or uses the same admin credentials as the rest of the network. Immutable snapshots or locked cloud storage, separate backup credentials with multi-factor authentication, and an off-site copy stop attackers wiping every restore point.

Microsoft keeps the service available, but under its shared responsibility model your data remains your responsibility. Recycle bins and version history have time limits, and a departed user's mailbox is eventually removed. A separate cloud-to-cloud backup gives you independent copies and retention periods you control.

Not on its own, because it sits in the same office as the data it protects. A NAS with snapshots is an excellent local copy for fast restores, but pair it with an encrypted off-site copy and at least one immutable restore point to cover theft, fire and ransomware.

A backup is a copy of your data. A disaster recovery plan is the written procedure for using those copies to get the business running again: who invokes it, which systems are restored first, where staff work meanwhile and who updates clients. Each system's RPO, RTO and restore test results sit at its core.

OneDrive protects against a lost or dead laptop, which is most of the risk, but it syncs deletions and encryptions just as reliably as it syncs new work. Keep the folder redirection, add a separate Microsoft 365 backup, and use an endpoint agent only for laptops that hold application data outside the synced folders.

Written by Srinivasan Ramachandran, Founder, Listonics · Published Jun 25, 2026 · Last reviewed October 24, 2026 · 2284 words