The 3-2-1 rule — 3 copies of your data, on 2 different types of storage media, with 1 copy offline or offsite. Cloud sync alone (OneDrive, Google Drive) protects against many ransomware variants but NOT all of them. Sophisticated attackers also encrypt cloud-synced files. Offline or immutable backups are the defence-in-depth layer.
“We’re in the cloud, so we’re backed up” is a common but dangerous belief. Microsoft 365 has 30-day Files Restore for OneDrive Business and 500 versions per file — useful, but not infinite. A determined attacker who gets full credentials can still cause damage that exceeds those windows. Offline backups (or immutable cloud backups) are what give you real defence-in-depth.
(see above)
Backup-as-a-Service with automated tested restores. We don’t just back up — we periodically try to restore, because untested backups have a habit of being broken when you actually need them.
Sources: Sophos State of Ransomware 2024 (47% of SMBs hit); Microsoft documentation on OneDrive Business retention.
Want to talk through this in your specific business context? The first 30 minutes is free — phone or Microsoft Teams. Book a free 30-min scoping call →
