Backup and Disaster Recovery: The Complete Guide

Most businesses have backups. Most discover they do not work when they actually need them. The Veeam 2025 Ransomware Trends Report found that 69 per cent of organisations were hit by a ransomware attack in the past year, and of those attacked only 10 per cent recovered more than 90 per cent of their data while 57 per cent recovered less than half. Veeam 2025 Ransomware Trends Report.

Attackers now deliberately target backup repositories before triggering encryption, because destroying your backups is the fastest way to force a ransom payment. Veeam 2024 found that 96 per cent of ransomware attacks attempted to modify or delete backups and 76 per cent of those attempts succeeded. Veeam 2024 Data Protection Trends.

The recovery cost gap is stark. Sophos reports that organisations with compromised backups face recovery costs around 8 times higher than those with intact backups, because the only remaining option is rebuilding from scratch or paying the ransom. Sophos State of Ransomware 2024.

The ACSC-endorsed 3-2-1-1-0 rule extends the older 3-2-1 baseline with two additions that matter in 2026: one immutable copy the attacker cannot delete, and zero failed backup jobs after verification. Immutable storage is now the single most important control against ransomware that specifically hunts backups. Veeam ransomware response 2026.

Veeam delivers native immutability across hardened Linux repositories, S3 Object Lock storage, tape and WORM, and Veeam Data Cloud Vault, so the one copy an attacker cannot reach is now achievable at every budget, not only in enterprise platforms like Rubrik or Cohesity. Veeam ransomware response 2026.

RTO and RPO are the two numbers that drive every backup tooling and budget decision. RTO is how long the business can survive without the system after an outage. RPO is how much data you can afford to lose, measured in time since the last good backup. Agreeing these with the business before you pick tools prevents over-spending on systems that need minutes and under-spending on systems that need days. Veeam ransomware response 2026.

Immutable backups cannot be changed, deleted, or encrypted, even by someone with admin credentials. This is the last line of defence. Azure Blob immutability, AWS S3 Object Lock in compliance mode, and Veeam hardened Linux repositories all provide this, with Veeam confirming backups are recoverable rather than just present through its SureBackup automated recovery verification. Veeam ransomware response 2026.

For long-term retention, offline or air-gapped tape remains unbeatable against remote ransomware, and is still in active use for archive and compliance windows where restore speed is not the priority. Veeam 2024 Data Protection Trends.

Microsoft 365 is not a backup. Microsoft protects its infrastructure, not your data against deletion, ransomware, or insider error. Deleted items sit in the recycle bin for 14 to 30 days and deleted mailboxes for 30 days, with the SharePoint and OneDrive recycle bin retaining content for 93 days before permanent deletion, and there is no point-in-time recovery beyond those windows. Microsoft 365 Backup overview.

Microsoft now ships a native Microsoft 365 Backup product that protects Exchange Online mailboxes, OneDrive accounts and SharePoint Online sites with a documented one-year retention period on a pay-as-you-go or seat-based model, but it is a retention and restore tool, not a true third-party backup with immutable off-platform storage. Collab365 Microsoft 365 Backup 2026.

For most businesses the practical answer remains a separate third-party backup such as Veeam for Microsoft 365, Afi, or Datto SaaS Protection, retained for 7 or more years for compliance and legal hold, because that is the only control that survives a compromised admin account or a ransomware encryption event. Collab365 Microsoft 365 Backup 2026.

Inventory every system that holds business data, set RTO and RPO per system with the business, apply 3-2-1-1-0 as the baseline, protect SaaS separately because the vendor does not back up your data to your standard, document and rehearse recovery, monitor every job every day, and review annually because RTO, RPO and data growth all drift over time. Veeam ransomware response 2026.

An untested backup is a hope, not a plan. Veeam SureBackup automates recovery verification to confirm backups are recoverable, and Veeam Recovery Orchestrator runs non-disruptive tests that validate RPO and RTO and auto-generate runbooks and recovery evidence, so testing stops being a once-a-year gamble. Veeam ransomware response 2026.

As a baseline, test file-level restores monthly, system or VM restores quarterly, and run a full disaster recovery simulation annually, timing it end to end. Most businesses discover their backups do not work only when they actually need them. Veeam 2024 Data Protection Trends.

The recurring failures are the same every time: backups were never tested, backups sat on the same network as production so ransomware encrypted them first, retention was too short for the deletion to be noticed in time, critical data was excluded by accident, a single destination failed the same week as the primary, and there was no recovery runbook so restoring a server took days because nobody had done it before. Veeam 2025 Ransomware Trends Report.