Backup and disaster recovery: a practical guide for businesses

Companies rarely lose data spectacularly. Far more often it looks like this: the drive in the machine everyone calls “the server” fails on a Monday morning, the only backup is an external disk plugged into that same machine, and nobody has attempted a restore in eighteen months.

The file exists. It will not open.

Backup is not a product you buy: it is a procedure you verify. Here is how to build one that holds on the day you need it, whether the cause is a failed disk or ransomware.

How much can you lose, and how long can you stop?

Before comparing tools, answer two questions with your management. They determine everything else.

RPO (Recovery Point Objective): how much data can you afford to lose? With one backup a night, you can lose up to a day of data entry. For a pharmacy or a depot recording hundreds of movements a day, that is often too much.

RTO (Recovery Time Objective): how long can you be down? An hour, a day, a week? The answer changes the architecture and the budget completely.

Both ideas structure the contingency planning guide NIST SP 800-34. Without them, a conversation about backup is a conversation about price, not risk.

The 3-2-1-1-0 rule, in plain terms

The classic rule is still the foundation:

• 3 copies of your data;
• on 2 different media;
• with 1 off site.

It protects against hardware failure and fire. It is no longer enough against ransomware, which looks for reachable backups to encrypt or delete them. The updated version adds two numbers:

• 1 immutable or disconnected copy, which nobody can change or erase during its retention period;
• 0 errors at the last restore test.

That final zero is what separates a real backup from an assumed one.

What almost everyone forgets to back up

Beyond office files, check that you cover:

• the database of your ERP, till or website, not just the application files;
• mailboxes: the deleted-items folder is not a backup;
• configurations of the router, firewall, access points and workstations;
• your website and its database — see Nematek One Hosting;
• video recordings, if you rely on them after a theft or a dispute — see cameras and networks;
• the accounting and contractual records you must produce during an inspection.

Write this list down. A backup whose scope is not written has gaps nobody knows about.

Scenario: ransomware at a hardware shop in Douala

The scenario is fictional, but each step follows the pattern described by the US cybersecurity agency in its #StopRansomware Guide.

Friday, 5 pm. In Bonabéri, an employee opens an “Unpaid invoice” email that seems to come from a supplier. Nothing happens on screen.

The weekend. The attacker uses her account, which can reach the whole shared folder. They find the “server” PC and the external disk permanently plugged into it.

Monday, 7:30 am. Files have been renamed. A note demands payment in cryptocurrency. The till database, the Excel file of customer debts and the external disk are all encrypted, because they were all reachable.

What saves the business comes down to two things prepared in advance: a copy out of reach, such as a second disk swapped weekly and kept in another building, or a remote backup with immutable retention, and a restore procedure already tested. Without them, customer debts have to be rebuilt from memory.

The first hours count:

1. Isolate the affected machines: unplug the network cable, switch off Wi-Fi. Power down only if you cannot disconnect them.
2. Keep the evidence: the ransom note, the original email, the time things were first noticed.
3. Do not reconnect the clean copy until the machines are cleaned or reinstalled.
4. Restore from the out-of-reach copy, starting with the till and the accounts.

Our guide to ransomware protection sets out the ten controls and the first 24 hours. As for Friday’s fake email, it is a classic scam that AI now writes without a single mistake: our guide to WhatsApp and Mobile Money scams shows how to spot it.

The four countermeasures that change the picture

• An immutable or disconnected copy, out of reach of everyday administrator accounts.
• Multi-factor authentication on email, remote access and backup consoles.
• Separation of duties: the account that writes backups must not be able to delete them.
• Retention long enough to cover an intrusion discovered late.

CISA’s #StopRansomware Guide, with its response checklist, and the French agency ANSSI’s guide Attaques par rançongiciels, tous concernés (in French) are practical places to start. The CIS Critical Security Controls then let you progress in stages instead of facing one overwhelming list.

Local realities that change the architecture

Expensive, irregular bandwidth

Sending hundreds of gigabytes to the cloud every night is not realistic everywhere. The usual answer is hybrid: a fast local copy for everyday restores, and an incremental remote copy for a major disaster.

Theft and fire

A disk kept in the same office as the server is not an off-site copy: a burglary or a fire takes both. “Off site” means another building or remote storage, not another drawer.

Power cuts and surges

An abrupt shutdown mid-write can corrupt a database as surely as a disk failure. A UPS with automatic clean shutdown is part of the backup strategy. See our guide to high availability.

Dependence on one person

If only one person knows the procedure and holds the credentials, the recovery plan collapses the day they are on leave in Kribi. Write the procedure down; at least two people must have run it.

Restore testing: the only step that proves anything

An untested backup is a hypothesis. A real test runs like this:

1. Pick a random date within your retention period.
2. Restore to a separate environment, never onto production.
3. Actually open the data: launch the application, look up a recent record.
4. Time it, and compare with your RTO.
5. Record the date, the person, the duration and any problems.

Do it at least once a quarter, and after every infrastructure change.

What does a serious backup cost?

The budget is made of storage (local disks, remote space billed by volume), the time spent on tests, and monitoring. Our starting prices are published in FCFA on the pricing page: Nematek One Secure covers backup, retention and restore testing, Nematek One Hosting includes backups depending on the plan, and Nematek One Support provides periodic backup checks depending on the support plan.

Your starting checklist

• ☐ RPO and RTO defined and approved by management
• ☐ Backup scope written down, databases and email included
• ☐ 3-2-1-1-0 rule applied, with an immutable or disconnected copy
• ☐ Automated backups, with an alert on failure
• ☐ Quarterly restore test, timed and recorded
• ☐ Written procedure, known to at least two people
• ☐ UPS with clean shutdown on critical equipment
• ☐ Multi-factor authentication on remote and backup access

Reviewing where you stand

If you cannot answer “when did we last restore, and how long did it take?”, now is the right time for a review.

We work in cybersecurity, cloud and continuity and IT support. Request a free assessment.