And who is responsible for making sure your business can recover
By Trevor Mifsud, CEO at vCloud Group

Backups are one of those business topics that often get pushed aside until something goes wrong.

A server fails. A NAS stops responding. A Microsoft 365 mailbox is deleted. A website breaks after an update. A ransomware event hits shared files. A staff member loses a laptop with important local data. Then the same question gets asked:

“Can we get it back?”

That question matters because in most businesses, data is not just data. It is time, money, customer history, business knowledge, and operational continuity. If it would take a substantial amount of time to recreate, it should be properly backed up.

That includes websites, web hosting environments, Microsoft 365 or Google Workspace data, servers, NAS devices, and critical files stored on local PCs or laptops.

At vCloud Group, we take a very clear view on backups.

It is the IT provider’s job to recommend the right solution, explain the risks, design the backup strategy, configure it correctly, and make sure the platform is working as intended.

It is the business owner’s job to make the decision to move forward with that solution and to make sure backup testing is requested and understood, unless there is already an agreed managed schedule in place for regular testing.

That distinction matters.

A good IT provider should not have to twist a business owner’s arm into protecting their own business. Our role is to advise, explain, and implement. The owner’s role is to decide whether the business is willing to accept the risk of not proceeding.

That is a much healthier and more honest conversation.

A useful way to think about backups is to compare them to business insurance.

An insurance policy is there in case something goes wrong. But if the policy does not really cover what matters, if the paperwork is incomplete, or if the claim process fails when you need it, then the protection is not worth much.

Backups work the same way.

It is not enough to simply say, “We have backups.” The real question is whether those backups will restore what you need, in the time you need, when the business is under pressure.

This is why backup and restore testing matter so much. A backup that has never been tested is like an insurance policy nobody has ever checked. It may be fine. It may not. But you do not want to find out during a crisis.

What Needs to Be Backed Up

The first rule is simple: if the business would suffer without it, it needs backup protection.

That includes your website. The files, database, themes, plugins, forms, images, and any custom work all carry value. If the site breaks, gets hacked, or disappears, rebuilding it may take days or weeks.

It also includes the web hosting environment. A website rarely exists as a single set of files. There may be databases, DNS records, staging environments, configurations, or other linked services in that hosting platform. If the hosting layer fails, that affects more than just the public site.

Then there is Microsoft 365 or Google Workspace. Many businesses still assume that because the platform is in the cloud, backup is fully handled. That is not always true in the way business owners expect. Mailboxes, OneDrive, SharePoint, Teams data, Gmail, Google Drive, and shared workspace content all require careful consideration.

Your servers need backup too. Whether they are physical or virtual, they often run key applications, file shares, databases, or line-of-business systems. If they fail, restoring them quickly may be critical to operations.

The same goes for NAS storage. A NAS is not a backup by itself. It is still just storage. If it fails, gets corrupted, or is encrypted, the business still needs a clean recovery path.

Finally, local PCs and laptops should not be ignored. If critical data is being stored locally, then that data belongs in the backup discussion too.

This is where we need to be very clear.

The IT provider’s job is to provide the solution.

That means the provider should assess the business, identify the critical systems, explain the risks, recommend a backup strategy, and implement a system that is fit for purpose. The provider should also make sure the backup jobs are configured properly, that alerts and reporting are in place, and that the solution is functioning as designed.

If the solution is managed, the provider should also carry out the agreed monitoring and testing tasks under that service arrangement.

In other words, the provider is responsible for the technical side of making the backup platform work.

At vCloud Group, that is exactly how we see it. We can advise on what needs protecting. We can design the backup strategy. We can implement the tools. We can monitor them. We can even build structured backup and testing schedules into managed agreements.

But advice is not the same as forcing a decision.

A provider should not bully or pressure a business owner into buying something. That is not good practice. The better approach is to explain the risk clearly, set out the options, and let the owner decide whether they want to protect the business properly.

The business owner’s role is different, but it is just as important.

The owner decides what level of risk the business is willing to accept.

That means the owner needs to hear the advice, understand the consequences of not having backup in place, and make a decision. If the provider recommends backup for a website, a Microsoft 365 environment, a NAS, or a server, the owner must decide whether they want to proceed.

The same applies to testing.

Unless there is an agreed managed testing schedule in place, it is

the business owner’s responsibility to ask for backup testing and request confirmation that restore testing has been done. A business should not assume testing is happening automatically unless that has been clearly included in the support arrangement.

This is an important point because backup and backup testing are related, but they are not the same thing. A system may be taking backups every day, but unless restore testing is occurring, there is still uncertainty.

That is why business owners need to ask the question:

“When was this last tested?”

Why Testing Matters So Much

Backup without testing is incomplete.

It may look good on paper. It may even report successful jobs. But what the business actually needs is proof that recovery will work.

Testing can mean different things depending on the system.

For a website, it might mean restoring a copy of the site and confirming the database, forms, and pages all load correctly.

For Microsoft 365 or Google Workspace, it may mean restoring a mailbox, recovering a deleted file, or verifying a SharePoint or Google Drive restore.

For a server, it may mean restoring a full virtual machine or application environment.

For a NAS, it may mean recovering a folder set and checking data integrity.

The point is simple: a backup should be proven, not assumed.

If regular testing is not included in a managed agreement, then the owner must ask for it.

At vCloud Group, the 3-2-1 rule remains our gold standard for practical business continuity.

That means:

  • 3 copies of the data
  • on 2 different types of media
  • with 1 copy offsite

This model works because it avoids over-reliance on a single system, a single platform, or a single location.

If the office suffers a hardware issue, the offsite copy helps. If the live platform is corrupted, another copy exists. If one method fails, another remains available.

It is a strong, sensible baseline for businesses that want real continuity.

Why the 3-2-1-1-0 Rule Is the Future

The 3-2-1-1-0 rule takes that thinking further.

It adds:

  • 1 immutable or offline copy

  • 0 backup errors after verification

This matters because modern threats are more aggressive than they used to be. Attackers often target backups. Silent corruption can spread. A “successful” backup job may still contain problems that only manifest during restore.

An immutable or offline copy gives the business one stronger layer of protection if normal backup repositories are attacked or altered.

The zero-error principle reinforces testing and verification. It means backup success should not be assumed. It should be validated.

That is why we see 3-2-1-1-0 as the future of serious business continuity strategy.

Why This Is Not About Pressure — It Is About Responsibility

A strong provider should advise clearly. A strong business owner should listen clearly.

That is the right relationship.

At vCloud Group, we do not believe an IT provider should pressure a business owner into backup solutions through fear. We do believe it is our responsibility to explain the real-world consequences of not protecting critical systems properly.

If the owner decides not to move forward, that is the owner’s business decision. However, that decision should be made with full understanding of the risk.

A good analogy here is building safety.

A consultant can tell you the building needs fire extinguishers, smoke alarms, and emergency exits. They can explain the consequences of not having them. They can install and maintain the safety systems if engaged to do so. But the owner still decides whether to put them in place.

Backups work in much the same way.

The provider advises and implements. The owner chooses whether the protection is taken seriously.

A Practical Way for Business Owners to Think About It

If losing a system would be painful, ask these questions:

  • What would it cost us to recreate it?

  • How long would it take?

  • What would happen to the business while we did that?

  • Do we have backup for it?

  • Has that backup actually been tested?, and

  • Is testing part of our managed agreement, or do we need to ask for it?

Those questions alone will expose most gaps.

Final Thoughts

Backups are not optional if the data matters.

If a website would be expensive to rebuild, it needs backup. If Microsoft 365 or Google Workspace holds critical communication and files, it needs backup. If a server, NAS, or local PC stores important information, it needs backup too.

That is the baseline.

The IT provider’s responsibility is to recommend, design, implement, and support the right backup solution. If managed testing is included, the provider must perform that too.

The business owner’s responsibility is to accept or decline that advice and to ask for backup testing unless there is already a clear managed testing schedule in place.

At vCloud Group, we can advise, design, and set these systems up properly. We can build them into a broader business continuity strategy. But the owner still has to choose to protect the business.

That is not pressure. That is ownership.

Because when something goes wrong, the question will never be whether the provider recommended backup.

The question will be whether the business chose to make recovery possible.