Assessment: How Does Your Arkansas Business Stack Up on Data Backup?

Do you have at least three copies of your critical data — the original plus two backups?

The original, live copy counts as one. A second copy sitting on the same drive as the original doesn't count as a separate copy.

Are those backups stored on at least two different types of media?

"Media type" means the kind of storage technology — an external hard drive, a NAS device, cloud storage, and tape are all different types. Two backups saved as two folders on the same device are the same media type, not two.

Is at least one copy stored offsite, separate from your primary systems?

A different building, a different cloud account/region, or a different provider entirely — not just a different folder on the same network.

Is at least one copy immutable or air-gapped?

"Immutable" means the backup can't be altered or deleted for a set period, even by someone with admin credentials (sometimes called "object lock"). "Air-gapped" means it's physically or network-disconnected from your main systems. Either one protects the backup if your main systems are compromised.

Was your most recent full restore test completed with zero errors?

A restore test means actually recovering the data — not just confirming a backup job finished — and verifying it opens or functions correctly.

Do you spot-check individual file, folder, or mailbox restores at least monthly?

A quick, low-effort check that backups are working day-to-day — not a full system recovery.

Do you test a full system or environment restore at least once a year?

A larger-scale test simulating your main systems being unavailable, confirming you can rebuild from offsite/cloud backups alone.

Is deleting or modifying backups restricted to separate credentials from everyday admin access?

Day-to-day IT admin accounts shouldn't be the same accounts that can delete or alter backups — this stops one compromised login from wiping backups too.

Are your Microsoft 365 / Google Workspace mailboxes and files backed up independently, rather than relying only on the vendor's built-in retention?

A vendor's recycle bin or retention policy isn't an independent backup — it's still controlled by the vendor, time-limited, and can be lost if an account or subscription is deleted.

Is it documented in writing who owns your data if your backup or cloud vendor goes out of business or is acquired?

A contract clause spelling out data ownership and what happens to your access if the vendor is sold, acquired, or shuts down.

Is there a written recovery plan documenting who does what during a restore?

Named people and responsibilities for a data-loss event — not something that depends on one person's memory.

Do you get notified automatically when a backup job fails?

Automatic alerting, rather than only finding out when someone manually checks the logs.

Are employee laptops and devices included in your backup scope, not just servers?

Covers endpoints — laptops, desktops — not just centralized servers and cloud apps.