Data backup

What it means

Backup means regular copies of data kept somewhere separate, from which operations can be restored. The tested rule is three copies, two different media, one off site.

A backup is not retention. An archive keeps documents for the statutory period; a backup exists to restore operations after a failure, an attack or a mistake.

Synchronisation and disk mirroring are not backups. They protect against one device failing, but they copy a mistake, a deletion or ransomware encryption to every replica instantly. A real backup keeps several versions over time, and at least one is isolated so that an attacker using an ordinary account cannot alter it. It is the foundation of any disaster recovery plan.

How it works in practice

In accounting that means the accounting software database, payroll data, e-mail and documents in cloud storage. Cloud needs backup too, because deletions synchronise.

Two numbers define a backup: how much recent data you would lose and how long restoring takes. Without them nobody can say whether the setup is adequate for a given company.

For accounting data we also set how long backups are kept. An accounting error is often found only months later, for instance at the annual closing, and then the database version from before the error is what is needed. A backup that holds only the last week will not help, however flawlessly it runs otherwise.

What to watch out for

A backup nobody has ever test-restored is not a backup. A periodic test restore exposes missing passwords, corrupted files and incomplete copies before a real incident does.

A backup holds data as sensitive as the live systems: salaries, personal ID numbers, bank details. An unencrypted backup drive left in a car or a public cloud link is a personal data breach with all the duties that follow. So we encrypt backups and restrict access to them as strictly as to the accounts themselves.