In short: Cloud backup for business is an independent copy of your data, held away from the systems it protects, that you can restore after deletion, ransomware or an outage. A sound plan covers Microsoft 365 and other SaaS, servers and endpoints, uses immutable storage, and is proven by regular test restores.
Why backup is part of cloud security
Ransomware groups know that a clean backup is the main thing standing between them and a payment, so they now go after backups first: deleting snapshots, encrypting backup servers and signing in to backup consoles with stolen admin credentials. Accidental deletion, a bad sync, a departing employee wiping files and a misconfigured retention policy cause far more day-to-day data loss than attackers do.
Moving to the cloud does not remove the problem. Microsoft, Google and other SaaS providers keep their services running, but under the shared responsibility model your data, and getting it back, is your job. Our guide to what cloud security is explains that split. Backup is also the control that turns a serious incident into a recoverable one, which is why insurers, auditors and the NCSC all ask about it.
The 3-2-1 rule and immutability
The long-standing rule of thumb still works when translated for the cloud:
- 3 copies of your data: the live data plus at least two backups
- 2 different types of storage or platform: for example the SaaS service itself and an independent backup cloud
- 1 copy off-site and isolated: separate from your production accounts, so an attacker with your admin credentials cannot delete it
Modern guidance adds two more requirements. Backups should be immutable, meaning they cannot be changed or deleted for a set period, even by an administrator, and they should be tested, because a backup nobody has restored is only a hope. The NCSC's principles for ransomware-resistant cloud backups make the same points: protect backups from destructive actions, keep enough history to go back to a point before the attack started, and make sure you can recover even if your main accounts are compromised, and raise alerts when someone attempts a mass deletion or a change to retention. Secure the backup console itself with phishing-resistant MFA and as few admins as possible; our identity security guide covers how.
What needs backing up
Most organisations have three or four different kinds of data, and one product rarely suits all of them equally well.
| Data | Typical risk | Backup approach |
|---|---|---|
| Microsoft 365 or Google Workspace (mail, OneDrive, SharePoint, Teams, Drive) | Deletion, overwrite, ransomware syncing encrypted files, retention gaps | Cloud-to-cloud SaaS backup with no agent: see Microsoft 365 backup |
| Identity (Microsoft Entra ID users, groups, Conditional Access policies) | Accidental or malicious changes; Microsoft's native recovery history is short | Directory backup, often bundled with SaaS backup |
| Servers and virtual machines (on-premises, Microsoft Azure and other clouds) | Ransomware, hardware failure, site loss | Image-based backup with cloud copies and disaster recovery |
| Laptops and desktops | Theft, loss, ransomware on local files | Endpoint backup, or keep files in OneDrive and back that up |
| Other SaaS (CRM, finance, DevOps tools) | No native backup, or limited retention | SaaS backup platforms that support those apps |
Backup and disaster recovery (DR) are related but different. Backup gets data back; DR gets a whole service running again, for example by starting a failed server as a virtual machine in the cloud while the original is rebuilt.
RPO and RTO in plain English
Two measures describe what a backup plan has to achieve:
- Recovery point objective (RPO): how much data you can afford to lose, measured in time. If backups run once a night, a failure at 5pm can lose a working day.
- Recovery time objective (RTO): how long you can be without the system. Restoring a single file takes minutes; rebuilding a server from scratch can take days unless you can run it from a backup image in the meantime.
Set these per system, not for the whole organisation. A finance server may need hourly backups and a recovery within hours, while an archive share can tolerate a day. The answers decide the product: SaaS backup tools typically run several times a day, while server BCDR tools such as Axcient x360Recover and Acronis can take frequent snapshots and start a protected machine as a virtual machine for fast recovery. Retention matters too: ransomware often sits undetected for weeks, so keep enough history to go back past the point of infection.
Options we work with
These are the backup platforms we supply and support. Each takes a different approach, so we match them to your estate rather than defaulting to one.
| Option | Best fit | What it covers |
|---|---|---|
| NinjaOne SaaS Backup (powered by Dropsuite) | Simple per-user Microsoft 365 and Google Workspace backup, with optional archiving | Microsoft 365, Google Workspace, optional Entra ID backup and journaling email archive |
| Acronis Cyber Protect Cloud (now Acronis Cyber Platform) | One agent and console for backup, DR and endpoint security | Servers, VMs, workstations, Microsoft 365, Google Workspace, plus security add-ons |
| Axcient x360Recover and x360Cloud | Server and PC continuity without an on-site appliance | Image-based server and workstation backup with cloud virtualisation; Microsoft 365 and Google Workspace |
| Keepit | Independent SaaS backup across many applications | Microsoft 365, Entra ID, Google Workspace, Salesforce, Dynamics 365, Power Platform, Okta and others |
| Redstor (powered by CyberSentriq) | Cloud-first backup with no backup hardware, managed from one app | Microsoft 365, Google Workspace, on-premises infrastructure and Azure workloads, with malware scanning of backups |
| Commvault Cloud (Commvault Cloud Unity platform) | Larger or more complex hybrid and multi-cloud estates | Microsoft 365, Google Workspace, Salesforce, VMware and cloud-native workloads, Active Directory and Entra ID, with on-demand cleanrooms for recovery testing |
| Hornetsecurity 365 Total Backup | Microsoft 365 backup alongside Hornetsecurity email security | Exchange mailboxes including in-place archives, OneDrive, SharePoint, Teams chats, Planner, OneNote, and Entra ID users and groups |
Licensing for each vendor is covered on our sister site: Keepit, Redstor, Commvault and Hornetsecurity 365 Total Backup. Microsoft also sells its own Microsoft 365 Backup service, which we compare on the Microsoft 365 backup page.
How to choose, and how we help
Start from the data and the recovery you need, then pick the product:
- List what you hold and where: SaaS tenants, servers, virtual machines, laptops and any other cloud apps
- Agree RPO, RTO and retention for each system with the people who run them
- Decide whether you want one platform for everything or the best tool for each workload
- Check data location (UK or EU storage for UK GDPR), immutability and how the backup console is secured
- Run a test restore during the trial, and schedule regular tests after go-live
We review your current backups as part of a cloud security assessment, including whether they would survive an attacker with admin access, then design, deploy and monitor the replacement. Backup works best alongside prevention: endpoint security and XDR, email security and a properly configured Microsoft 365 tenant. Pricing depends on users, workloads and storage, so ask us for a quote.
Contact us to review your backup and recovery plan.
Explore Cloud backup
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is cloud backup safe from ransomware?
It can be, if the backup is immutable, stored separately from your production accounts and protected by its own strong authentication. Ransomware that reaches a backup server or console with admin rights can delete ordinary backups, so check that deletions are delayed or blocked and that you keep enough history to restore from before the attack.
What is the 3-2-1 backup rule?
Keep three copies of your data, on two different types of storage or platform, with one copy off-site and isolated. For cloud services that usually means the live SaaS data plus an independent backup held in a separate cloud that your normal admin accounts cannot delete.
What is the difference between backup and disaster recovery?
Backup restores data, such as a deleted file or mailbox. Disaster recovery restores a working service, for example by starting a failed server as a virtual machine in the cloud so staff can carry on while the original is repaired or rebuilt.
Do I need to back up Microsoft 365?
Yes, in most cases. Microsoft keeps the service available, but recycle bins and retention policies are time-limited and are not designed as an independent backup you control. A separate backup protects against deletion, ransomware and retention mistakes.
How often should backups be tested?
Test restores should be part of normal operations: individual file and mailbox restores regularly, and a full server or site recovery test at least once a year or after major changes. A test is the only way to prove your RPO and RTO are realistic.