A backup is only worth something if the restore works. A backup project is therefore as much about how data is recovered as about how it is copied, and about how much downtime the business can tolerate.
Short answer
You describe your needs once: your request is reviewed by the Courtier TI team, then entrusted to the IT services company that will prepare your quote.
What the quote should cover
- The systems and cloud services included in the backup
- Frequency, backup type and retention period for each
- Where copies are kept, including the offline copy
- How and how often restores are tested
- How to request a restore and who to contact
What a backup project involves
- An inventory of data and systems: workstations, servers, business software, email and online files, including Microsoft 365 or Google Workspace.
- Ranking by importance. The Canadian Centre for Cyber Security recommends identifying the information that is essential to the business and how frequently it changes.
- Choosing the backup type for each system (full, differential or incremental) and how often each one runs.
- Choosing locations: onsite, offsite or in the cloud, with at least one offline copy.
- Encrypting the copies and restricting access to the people responsible for testing and restores.
- Writing the restore procedure, including everyone's roles and responsibilities.
- Regular restore tests and follow-up on alerts when a backup fails.
Questions to ask yourself before requesting a quote
- Which systems and data does the business need to keep operating?
- How much recent work can the business afford to lose?
- How long can the business operate without its systems?
- Are your email and online files part of your current backups?
- Do you have retention obligations or requirements about where data is stored?
- Who in-house must be notified if a backup fails, and who can request a restore?
Risks and pitfalls to avoid
- Backups that are always connected. The Canadian Centre for Cyber Security recommends having a backup stored offline: because it is not connected, it remains unaffected by many cyber threats, like ransomware.
- A NAS as the only copy. The Centre points out that ransomware can spread to network-attached storage devices and compromise your backups.
- Copies kept onsite only, exposed to the same fire or flood as the original data.
- Backups that are never tested. The Centre recommends testing the recovery process on a routine basis and testing your backups to make sure they work.
- Assuming cloud data is protected. The Centre notes that your organization is always legally responsible for protecting its data, even when a service provider takes care of backups.
- Thinking backups solve everything. According to the Centre, backups help you restore systems, but they won't prevent a threat actor from selling or leaking stolen data.
What to specify in your request
- The list of systems to back up and their approximate volume
- The cloud services to include: email, file storage, online software
- How much data loss and downtime you can tolerate
- Preferred locations and any data residency requirements
- The retention period you want
- How often restores should be tested and the report you expect
- Who receives alerts and who can request a restore
- The link with your disaster recovery or continuity plan, if you have one
You can then describe your project: the team will contact you to clarify your needs and send you a quote.
Frequently asked questions
What is the 3-2-1 rule?
The Canadian Centre for Cyber Security recommends adopting the 3-2-1 rule: 3 copies of your information (1 original and 2 backups), saved on 2 different media types, with 1 copy kept off site. The Centre also recommends keeping a backup stored offline.
Is our Microsoft 365 data already backed up?
Don't assume it is. The Canadian Centre for Cyber Security notes that your organization remains legally responsible for protecting its data in the cloud. Ask for the quote to state whether mailboxes, OneDrive, SharePoint and Teams are included, where the copies are kept and how a restore is requested.
How often should we back up?
According to the Canadian Centre for Cyber Security, every system has its own requirements and frequency is decided case by case. For example, critical workstations and servers may require daily incremental backups, whereas desktops may be recovered from one common image.
What is the difference between a backup and a disaster recovery plan?
Backups are the copies. The recovery plan describes how to get the business running again from those copies: the order in which systems are restored, who does what, and how employees and clients are kept informed. The Canadian Centre for Cyber Security recommends outlining how the recovery process will be performed, including roles and responsibilities.
Can we store our backups outside Québec?
If the backups contain personal information, section 17 of Québec's Act respecting the protection of personal information in the private sector requires a privacy impact assessment before entrusting their keeping to an organization outside Québec, along with a written agreement. See our guide Law 25: what SMBs need to do on the IT side.