Is Microsoft 365 already backed up?

Not in the sense most people mean. Microsoft keeps the service available and replicates it across data centres, which protects against their outage, not against your deletion, a compromised account or a retention setting nobody understood. Recovering a mailbox someone emptied four months ago is your problem, not theirs, and their agreement says so.

No. A NAS is one device, usually in the same building as the thing that would destroy it. RAID protects against a failed disk — not against ransomware, fire, flood, theft or someone deleting the wrong folder. A NAS needs a backup of its own.

How long would it take to get us running again after ransomware?

It depends on what was hit, how much data there is and how quickly the incident is contained, and any provider quoting a fixed number without seeing your systems is guessing. What can be said in advance is the order of recovery, which systems come back first, roughly how long each has taken when tested, and what the business would have to do without in the meantime. That gets written down before it is needed, not during.

How do you know the backups work?

Because a restore is performed and the result is checked, on a schedule, rather than a green tick being taken at face value. A backup nobody has restored from is a hope, not a backup — most failed recoveries are of backups that had been reporting success for months.

Backup & recovery

The question isn't whether you're backed up. It's what happens on Tuesday.

Most small businesses have something they'd call a backup. Far fewer could say which systems it covers, when it was last tested, or how long they'd be unable to invoice if they had to use it. Those are three different questions and only the last one costs money.

Find out what's actually covered What's in each package

What gets backed up, layer by layer

This is the part people find surprising, so it's worth being blunt about it: the daily backup included in a support package covers Microsoft 365. Email, OneDrive and SharePoint. If your business also has a server, a NAS or a database, each of those needs its own arrangement — and each is priced, so it belongs in your first quote rather than in a conversation after something has gone wrong.

Microsoft 365 — email, OneDrive, SharePoint

Included with Managed and Complete, an add-on on Essentials.

Backed up daily to storage that isn't Microsoft's, so a deleted mailbox, a compromised account or a retention policy nobody understood can be undone. Microsoft keeps the service running; what's in it is your responsibility, and their own agreement says so.

Servers and virtual machines

Part of server care — $220/mo per host or virtual server.

Image-level backup, so the answer to a dead server is a restored server rather than a rebuild from memory. Where the workload matters enough, a copy off site as well as on.

A NAS, or the file share that has everything on it

Part of NAS / storage care — $110/mo per device.

A NAS is not a backup. It's a single box, usually in the same room as the thing that would burn it — and RAID protects you from a dead disk, not from ransomware, a flood or someone deleting the wrong folder. It needs a copy somewhere else.

The database your business actually runs on

Scoped and quoted — it depends on the software.

Job management, practice management, accounting, design archives. These are the ones people assume are covered and usually aren't, because the vendor's own backup often protects the vendor rather than you. We check what it really does before saying it's handled.

The things nobody lists

Written down as part of the work.

The domain name and who controls it. The DNS records. Licence keys. The admin account for the phone system. None of it is data, all of it is needed on the worst day, and it's usually the part that adds days rather than hours.

Two things people believe that aren't true

"Microsoft backs it up."

Microsoft keeps the service running and copies it across data centres, which protects you from their bad day. It doesn't protect you from yours. A mailbox emptied four months ago, a compromised account that deleted its own trail, a retention policy someone set in 2019 — all yours to recover, and their own agreement says as much.

"We've got a NAS, we're fine."

A NAS is one device, generally in the same room as whatever would destroy it, and RAID only protects against a disk dying. Ransomware encrypts a mapped drive as happily as a local one. A NAS is worth having — it just needs a backup of its own, ideally somewhere the building isn't.

What happens on the day

Here's the honest answer to "how long until we're running again": it depends on what was hit, and anyone quoting you a number without having seen your systems is guessing at your expense.

What can be settled in advance is the shape of it, and that's the part worth having in writing before you need it:

The order. Which system comes back first. For most businesses it's the one that lets you invoice and the one that lets you talk to customers — rarely the one people assume.
The gap. How much work you'd redo. A nightly backup means you could lose a day; that may be perfectly acceptable for a document archive and completely unacceptable for a live job system, and those are different products at different prices.
The workaround. What the business does in the meantime — on paper, on phones, from a laptop. The businesses that come through this well are the ones that had thought about it for twenty minutes in advance.
Who you ring. Us, your insurer, and — above a turnover threshold — the obligations that come with a ransomware payment. If you carry cyber insurance, the policy usually names who must be called first, and calling the wrong person first can affect the claim.

We won't publish a recovery-time promise, because a number we can't hold in every case is worth less than none. What we'll do is test the restore, tell you what it actually took, and write down what you'd be without while it runs.

Tested, not assumed

Nearly every failed recovery we've been called into was a backup that had been reporting success for months. The job was running. Nothing was in it, or it held the wrong thing, or nobody had the key.

So a restore gets performed and the result gets checked, on a schedule, and you're told what came back and how long it took. It's unglamorous and it is the entire difference between a backup and a recovery.

A backup nobody has ever restored from is a hope with a receipt.

Get your backups checked The rest of the security picture