A backup that runs every night shows that a job ran and little else. For business data backup in Basildon and across Essex, the more useful test is recovery of the right data from the right point in time. This guide gives you six checks to review your arrangements.

Why data backup and recovery can fail when backups are running

Copying data has become routine. The government’s Cyber Security Breaches Survey 2025/2026 found that 74% of UK businesses back up data securely through a cloud service, while only 44% have a business continuity plan that covers cyber security, down from 53% the year before.

Regulators expect more than a copy. The ICO’s UK GDPR security guidance says organisations must be able to restore access to personal data in a timely manner after a technical incident, and must regularly test the measures they rely on.

Backups fail in ordinary ways. A job can finish every night while skipping an application added last year or a cloud platform that was never brought into scope. Failed jobs can go unseen, and retention can turn out shorter than assumed. Copies may also sit on the same network as the live data, and the National Cyber Security Centre (NCSC) has reported ransomware encrypting connected USB and network drives that held backups.

How to check your business data backup in Basildon

Work through these six checks with whoever manages your IT.

1. What is being backed up?

List where important data lives today, including servers, employee devices, Microsoft 365, other cloud platforms, shared drives, line-of-business applications and databases. Compare it with the backup scope line by line. A solution configured years ago reflects where data lived then, and every application added since is a candidate for omission.

2. How often does the backup run?

Treat this as a business question. If the last backup ran at 02:00 and a system fails at 16:00, fourteen hours of work is gone. Decide how much loss is tolerable and test the schedule against it. The NCSC notes that the more frequently backups are created, the less data is lost on recovery.

3. How long are backups kept?

Retention is easy to overlook. Microsoft keeps permanently deleted Exchange Online mailbox items for 14 days by default, up to 30, and the SharePoint recycle bin holds deleted items for 93 days. A deletion discovered later may leave no recoverable copy unless separate retention is in place. The right period depends on your data, business needs and compliance obligations, so confirm yours and who agreed it.

4. Where are the copies stored?

If live data and backups share a network, a building or a set of credentials, one incident can reach both. The NCSC advises keeping at least one backup offline at any given time, so a single compromise cannot reach every copy.

5. Is anyone checking for failed backups?

Automated backups still need a person watching them. Find out who receives the alerts, who reviews failures, how quickly they are investigated and if recurring faults get followed up. A scheduled job offers little protection if it has failed for weeks unnoticed.

6. When was something last restored?

This is the most important test. A successful status shows that data was copied. A restore shows that it can be used. Pick a file or a mailbox, restore it, and repeat for a full system if you can. Confirm the right files and version come back, and time the process against what the business can accept. The ICO expects testing to be documented and acted on, so record the result and agree on a schedule you can keep.

Common data backup problems found during a review

Microsoft 365 is a common oversight. Microsoft’s shared responsibility guidance keeps customer data with the customer in every deployment model, Microsoft 365 included, and the retention windows above are short. A separate backup of mailboxes, Teams, OneDrive and SharePoint is a decision to make deliberately.

Other findings include a new application launched without being added to the schedule and an older server protected diligently, while a newer system holding more important data was missed. A backup can also exist and still take far longer to restore than expected, because bringing a large volume of data back over an internet connection is slower than copying it up each night in small increments. Outbound’s case study of a cloud-managed Microsoft 365 backup platform for a UK charity shows this protection in practice.

Keeping backup and disaster recovery reliable over time

Backup works best as a process someone reviews on a schedule. After these checks you should be able to state what is protected, how often it runs, how long copies are kept, where they are held, who monitors the process and when recovery was last tested. Any answer you cannot give is the next fix.

Outbound is based in Basildon and has more than 20 years of IT experience, so data backup in Basildon and the wider Essex area is an area we know well. Our Virtual IT Department is built around ongoing monitoring and review, and its Secure Plus plan includes an annual Disaster Recovery Assessment.

Not sure how your current backup setup would perform when you needed it? Outbound can take a second look at what is protected and how recovery is tested. Get in touch for a review.

FAQs

What is the 3-2-1 backup rule?

It means keeping at least three copies of your data, on two devices, with one off-site. The NCSC adds that it does not require any copy to be offline, so it also advises keeping one offline.

What is the difference between backup and disaster recovery?

A backup is a copy of your data. Disaster recovery is the wider plan for restoring systems, access and normal working after an incident, including who does what and in what order.

What do RPO and RTO mean?

Recovery point objective (RPO) is the maximum data loss you can accept, measured in time. Recovery time objective (RTO) is the maximum time a system can stay unavailable after an incident. Microsoft’s reliability guidance defines both this way.