A backup service is only worth what it restores. Ours keeps a local copy on a NAS for fast recovery, an independent off-site copy that a compromised office network cannot reach, and separate coverage for Microsoft 365. Restores are tested on a schedule and the result is written down.
Part of our guide to Cybersecurity.
Why do backups fail when they are needed?
Almost never because nobody bought one. The common causes are a job that has been reporting success while silently skipping the important folder, a copy that lives on the same network the ransomware reached, and a restore nobody ever attempted until the day it mattered.
That last one is the most common of all. A backup that has never been restored is a belief rather than a control, and the dashboard being green is not evidence. CISA's #StopRansomware Guide sets out why the isolated copy matters as much as the copy itself.
- Jobs reporting success while skipping the data that matters.
- The only copy sitting where the original problem can reach it.
- No restore ever tested, so recovery time is unknown.
- Microsoft 365 assumed to be backed up when it is not.
- Nobody watching the console, so a stopped job goes unnoticed.
What does the service actually include?
Three layers, because each covers what the others cannot. A local copy on a NAS gives the fastest restore when a laptop dies or a folder is wiped. An off-site copy under separate credentials survives fire, theft and a compromised office network. And Microsoft 365 is covered separately, because Microsoft protects the platform rather than your data inside it and sells retention as Microsoft 365 Backup rather than including it.
On top of that sits the part that makes it a service rather than a product: somebody watches the console, a restore is tested on a schedule, and you get the result in writing.
Where does a NAS fit, and where does it not?
A NAS is the right answer for fast local restores and for large files that are slow to sync, and it is a natural first destination for backups of laptops, servers and Microsoft 365 before they go off site. Synology sets out what each RAID level protects against in its RAID guide.
What a NAS is not is a backup on its own. RAID keeps the unit running when a drive fails; it does nothing for a deleted folder, a ransomware event or the comms room flooding. Our Synology and QNAP setup guide covers choosing and hardening the unit.
How long should a business keep backups?
Long enough to cover the problem you notice late, which is longer than most defaults allow. A deletion found the same week is easy; the one found during an audit a year later is the expensive case.
Retention should be driven by obligation first. Records relating to tax and accounting have required periods set by the UAE Federal Tax Authority and should be confirmed with your accountant rather than assumed, and contract correspondence often needs to outlive the project. We set retention against those requirements rather than against a product default.
What should be backed up that offices usually miss?
The servers and the file share get backed up because they are obvious. The gaps are the things nobody thinks of as systems until they are gone.
Laptops belonging to people who are rarely in the office hold work that never reaches a server, and a stolen or dead machine takes it with them. Line-of-business applications often keep a local database on one workstation rather than on the server. Configuration is data too: a firewall's rules, a switch's settings and the network documentation are all slow to rebuild from memory. And shared mailboxes and departed staff's accounts hold correspondence a dispute may need long after the person left.
- Laptops of staff who work off-site, where daily work never touches a server.
- Local databases held by an application on one workstation.
- Firewall and switch configuration, which is slow to rebuild from scratch.
- Shared mailboxes and the accounts of people who have left.
- The documentation itself, kept somewhere the outage cannot reach.
How is a restore tested?
By restoring something real, to somewhere separate, and opening it. We pick a file, a folder and a mailbox item, restore each to an alternative location, confirm the contents, time how long it took, and record the date and who did it.
That record is what turns a subscription into a control, and it is what an insurer, an auditor or a large client will ask to see. Anything that has not been restored is reported as untested rather than as working.
- A real file, folder and mailbox item restored, not a report reviewed.
- Restored to a separate location, so live data is never overwritten.
- Recovery time measured rather than estimated.
- Date, contents and operator written down and kept.
- Anything untested reported as untested.
What does cloud backup cost in Dubai?
The question most people arrive with, and the one most providers avoid on the page. The honest answer is that backup is priced on what has to be protected rather than on a flat rate: how much data there is, how many devices and mailboxes it lives on, how long copies must be kept, and how quickly you need to be working again after a loss. A ten-person office with files in Microsoft 365 and one shared drive is a small job. A firm holding years of project files with a regulator's retention period attached is a different one.
Listonics quotes backup as a fixed scope after a free assessment, and projects run from AED 2,500 to AED 30,000 depending on requirement. Ongoing monitoring and the monthly restore test sit inside a support agreement rather than being billed per incident, so a bad month does not produce a bigger invoice. Where Microsoft 365 is part of the picture, Microsoft's own add-on is priced on storage used, which it sets out in its pricing model for Microsoft 365 Backup; we cover what drives that figure on the Microsoft 365 backup cost page.
How Listonics runs backup
We start by checking what you have, because most offices have something and few know whether it restores. That review covers what is included and excluded, where the copies live, whether one is genuinely isolated, and what a restore would actually involve today.
From there we size and install the local NAS, set up the off-site copy and Microsoft 365 coverage, and run the first restore test with you watching. After that it is routine: monitoring, a scheduled restore test, and a written result. Our NAS storage and backup service page covers the scope, and a free backup assessment is where it starts.
Frequently asked questions
No. RAID keeps the unit running when a drive fails and does nothing for deleted files, ransomware, theft or fire. A NAS still needs its important shares copied somewhere independent, and that copy needs a tested restore. Treating RAID as backup is the most common mistake we find.
In almost every case yes. Microsoft keeps the service running and replicates your data, but under its shared responsibility model protecting the contents is the customer's job. Recycle bins and retention are measured in weeks, so a deletion found months later is unrecoverable without an independent copy.
Run them daily at minimum, and more frequently for systems where losing a day's work matters. Test a restore at least quarterly and after any significant change: a migration, a new provider, or new backup software. The test is what converts a subscription into a control.
The recovery depends entirely on whether a copy exists that the attack could not reach. That is why one copy is kept off-site under separate credentials rather than on a drive mapped to every desktop. We restore from the isolated copy after the cause is contained, not before.
Yes, and the first thing we do is test a restore from them rather than assume they work. The review tells you what is actually covered, where the copies are, whether any is genuinely isolated, and how long a real recovery would take. You keep those findings either way.
It depends on data volume, device and mailbox count, retention length and how fast you need to recover, so it is quoted as a fixed scope after an assessment rather than a flat rate. Listonics projects run from AED 2,500 to AED 30,000 depending on requirement, and monitoring plus the monthly restore test sit inside a support agreement rather than being charged per incident.
Written by Srinivasan Ramachandran, Founder, Listonics · Last reviewed September 27, 2026