Cloud service backups: protect what you keep in the cloud too

It is all in the cloud – do I still need a backup?

Yes, for things you cannot afford to lose. Think of the cloud as a well-run office building: someone else looks after the building, but you still need a way to recover your important papers. An accidental click, a compromised account or malicious changes can still cause trouble. NCSC recommends an independent copy of important cloud data in another safe location or service. [1]

Start here: take care of the essentials first

RoxIT recommends starting small and letting backups run automatically. At work, discuss this with the person responsible for IT.

• Choose what you must be able to recover. For example, customer documents, important email or family photos.
• Ask what is already protected. Which data can be restored, how far back and who will help you?
• Decide what you can afford to lose. Is yesterday's work enough, or do you need more frequent copies? Also decide how long you can manage without the material. This determines the setup. [7]
• Arrange a separate, protected backup of what matters. Ask IT or the provider to show that it runs automatically and that a failed job will be noticed. [8]
• Try restoring a file to a separate test folder. Open it and check its contents before relying on the solution.

Your checkmarks are stored only in this browser.

Sync, recycle bin and backup – what is the difference?

1. Synchronisation keeps the same files up to date in several places. If you delete a file, the deletion can follow it. Two screens showing the same folder are therefore no proof of two protected copies. [11]
2. The recycle bin and version history can undo a mistake. But the time available and recovery options are limited and depend on the service and settings. [2, 3]
3. A backup keeps copies you can restore from. Check that older, usable copies remain available even when the original changes or disappears. [1]

A common example: Microsoft 365

Microsoft's protection to keep the service running is different from recovering your content from an earlier point in time. Microsoft also distinguishes version history from dedicated backup for larger recoveries. Check what your subscription and chosen backup solution actually cover. Do not assume everything is included just because you use Microsoft 365. [2]

Lock the backup cupboard too

Attackers may try to destroy backups to make recovery harder. The copy therefore needs protection of its own. [4]

1. Separate administration. A compromised work account should not provide unrestricted access to all backups. Limit who can manage and delete them. [9]
2. Protect sign-in. Use an extra identity check at sign-in, known as MFA, and a unique password wherever passwords are used. [6]
3. Protect against deletion. Ask whether older copies can be locked against changes and deletion for a set period, even for administrators. This is often called immutable backup. [5]
4. Encrypt the copy in transit and in storage. This protects the contents from unauthorised viewing. Encryption does not replace protection against deletion. [10]
5. Protect recovery keys separately. If the encryption key is lost, the copy may become unusable. Check how keys can be recovered securely. [5]

A practical setup at home and at work

1. At home: start with what cannot be replaced. An extra copy of important cloud files on an encrypted external drive can supplement your protection. Disconnect the drive afterwards and store it safely. Update the copy regularly. [6, 8]
2. At work: RoxIT recommends a managed solution with clear responsibility, monitoring and recovery assistance. Compare the full cost, including help and time needed to recover the material. A cheap copy becomes expensive if nobody knows how to use it.
3. A backup helps you recover data. It cannot make stolen information secret again. Protect who can read and download the copies too. [4]

For IT: check these points before calling it done

RoxIT's practical checklist. Start with business needs and check the provider's current terms.

• Scope: document what is included and what is missing. Check shared mailboxes, Teams content, permissions and closed accounts, for example. A product name is not a contents list. [2]
• Separation: review accounts, permissions and deletion protection. A different provider alone is not proof of protection. Test the actual separation. [9]
• Emergency access: make sure backups remain accessible even if the company's normal sign-in is unavailable. [10]
• Timing and responsibility: decide how often copies are made, how long usable versions are kept and who follows up alerts about missed jobs or changed settings. Appoint a deputy too. [7, 8]
• Contracts and leaving: check storage location, access, recovery costs and how you can take your copies with you if you change services.
• Accounting and customer systems: if you use exported files, test that the data can be imported back into the system. A downloaded list is not automatically a complete backup.

Your checkmarks are stored only in this browser.

Test without putting the original at risk

RoxIT's suggestion: choose a harmless test file that has been included in a backup. Restore an earlier copy to another folder. Check the contents and who can open the file. Record the date, result and time taken. Do not delete the original to test. Repeat regularly and after major changes. Also read Your backup is only useful when you can restore it.

If it does not work: troubleshooting

1. The backup is green but the file is missing: check the account, folder and recovery point. Ask IT to check whether that type of content is included.
2. The file is gone and there is no backup: check the service's recycle bin and version history straight away. OneDrive has limitations, including after permanent deletion from its recycle bin. Ask for help promptly. [3]
3. It takes too long: try a smaller selection and ask IT to check how a larger recovery would work. Retrieving one file does not show how quickly the whole business can restart.
4. You suspect a breach or malicious files: contact IT or RoxIT immediately. Do not overwrite old copies or start a large recovery on your own. Recovery needs to take place in a checked, clean environment. [10]
5. The external drive contains only shortcuts or cloud icons: check that the actual file contents have been downloaded and can be opened without the cloud service.