RemoteBackup and recovery
A backup only counts if you can restore from it, fast enough, on your worst day.
Most businesses have backups. Fewer have tested one, and fewer still have a copy an attacker could not delete. Here is why backups fail, how to design one that survives ransomware, what the Essential Eight asks for, and what a day of downtime would actually cost you.
Essential Eight requirements from ASD. Checked 30 October 2026.
- Why backups fail
- Essential Eight backups
- Downtime cost calculator
Reviewed by Blake Bath, General Manager, on 30 October 2026.
What goes wrong
Six reasons backups fail when you need them.
None of these show up in a green backup report.
Never tested
The jobs said success. The restore did not work, or took days nobody planned for.
- Monthly file restores
- Quarterly system restores
- Timed
On the same network
Attackers found the backup server with the same admin login and deleted it first.
- Separate logins
- Offline or immutable copy
- Not domain-joined
Retention too short
The deletion was noticed after the backups had already rolled over.
- Match to how late you notice
- Monthly and yearly points
- Records rules
Things left out
The NAS, the accounting database or the cloud apps were never in the backup.
- Full inventory
- Cloud and SaaS too
- Review yearly
One copy, one place
The backup drive sat next to the server it was protecting.
- Offsite copy
- Different media
- Cloud copy
No runbook
Nobody had done a full restore before, so the order and passwords were worked out under pressure.
- Written steps
- Passwords stored safely
- Rehearsed
Downtime cost calculator
What would a day without your systems cost?
Use your own numbers. The answer tells you how fast your recovery needs to be, and how much a better backup is worth.
What would a day without your systems cost? Use your own numbers. This sets how fast your recovery needs to be.
Cost per working hour
A$1,881an hour of downtime
| If recovery takes | Estimated cost |
|---|---|
| 4 hours | A$7,525 |
| 1 working day | A$15,050 |
| 3 working days | A$45,150 |
| 1 working week | A$75,250 |
Staff cost and lost revenue only, using 48 working weeks of 40 hours. Recovery work, penalties and lost customers come on top.
The rule of thumb
The 3-2-1-1-0 rule.
- 3 copiesYour live data plus two backups.
- 2 types of storageFor example a local appliance and the cloud, so one failure does not take both.
- 1 offsiteAway from the building, for fire, flood and theft.
- 1 offline or immutableA copy that cannot be changed or deleted during its retention, even by an admin.
- 0 errorsRestores tested and verified, not just jobs reported as successful.
An industry rule of thumb, not a government standard. It lines up well with what the Essential Eight asks for.
What ASD asks for
Regular backups in the Essential Eight.
| Requirement | Level One | Level Two | Level Three |
|---|---|---|---|
| Back up data, applications and settings, synchronised, stored securely, tested in DR exercises | Yes | Yes | Yes |
| Staff cannot see others' backups, or change or delete any backups | Yes | Yes | Yes |
| Admins (other than backup admins) cannot see others' backups, or change or delete them | No | Yes | Yes |
| Staff and admins cannot see even their own backups | No | No | Yes |
| Backup admins cannot change or delete backups during retention | No | No | Yes |
Summary of ASD's guidance. Check the full maturity model wording before an assessment.
Our view
Design the restore first, then the backup.
Start from the recovery you need: which systems must be back first, how fast, and how much recent work you can lose. That decides whether you need a local appliance for fast restores, a cloud copy, or both, and how often backups run.
Then protect the backups from the people and accounts that run everything else. In Sophos's 2026 survey, data was encrypted in 56% of ransomware attacks and two-thirds of those victims recovered using backups. A copy that ordinary admin accounts cannot delete gives you the best chance of being in that group.
Building the plan
A backup and recovery plan in seven steps.
- Step 1Inventory
Servers, file shares, databases, Microsoft 365, cloud apps, laptops.
- Step 2Set RTO and RPO
Per system, agreed with the business, using the downtime cost.
- Step 3Design the copies
3-2-1-1-0, with one copy admins cannot delete.
- Step 4Protect cloud data
Microsoft 365, Google and line-of-business apps separately.
- Step 5Write the runbook
Order of restore, contacts and where the passwords are.
- Step 6Monitor daily
A failed job raises a ticket the same day.
- Step 7Test and review
Monthly, quarterly and yearly restores. Adjust as you grow.
Related guides
Backups are one part. Recovery is the plan around them.
Go deeper on the parts that matter most.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about backup and recovery.
What is the 3-2-1-1-0 backup rule?
Three copies of your data, on two different types of storage, one offsite, one that cannot be changed or deleted (offline or immutable), and zero errors when you test a restore. It is an industry rule of thumb that builds on the older 3-2-1 rule, not a government requirement, but it covers what the Essential Eight asks for.
What does the Essential Eight require for backups?
At every level: back up data, applications and settings in line with business criticality, keep backups synchronised to a common point in time, store them securely and resiliently, and test restores in disaster recovery exercises. Higher levels restrict who can see, change or delete backups, until at Level Three not even backup admins can delete them during their retention period.
Is Microsoft 365 backed up?
Not in the way a business needs. Deleted files sit in recycle bins for 93 days and deleted email for 14 days by default, up to 30. After that it is gone unless you have a backup. Microsoft 365 Backup and third-party services fill that gap.
What is the difference between RTO and RPO?
RTO, the recovery time objective, is how long you can be without a system. RPO, the recovery point objective, is how much recent data you can afford to lose. A four-hour RTO and a one-hour RPO need a very different setup from a three-day RTO and a one-day RPO.
Are snapshots a backup?
Not on their own. Snapshots usually live on the same storage and under the same admin accounts as the data. If that storage fails or an attacker gets admin, the snapshots go too.
How often should we test restores?
A file or mailbox restore every month, a full server or system restore every quarter, and a disaster recovery exercise at least once a year. Time each one and write down what went wrong.
Next step
When did you last restore something?
We will check what is backed up, who could delete it, and test a restore with you, so you know what a bad day would really look like.
Keep reading
- Backup and DR Our service.
- Microsoft 365 backup Cloud data.
- Ransomware Recovery.
- Essential Eight Baseline.
Reviewed by Blake Bath, General Manager, on 30 October 2026. Essential Eight requirements summarised from ASD. Survey figures are global and self-reported. Checked 30 October 2026. ASD Blueprint, Essential Eight regular backups; ASD, Recover from ransomware; Sophos, State of Ransomware 2026; Microsoft Learn, SharePoint data deletion; Microsoft Learn, Exchange data deletion