Backups that "succeed" are not the same as backups you can restore under pressure. Modern ransomware targets backup consoles, deletes snapshots, and encrypts reachable shares. A resilient design assumes attackers may obtain domain-level access and still plans for recovery: immutable copies, isolated credentials, and routine restore drills.
1) Define RPO/RTO by system (not by opinion)
Start with business targets. Typical SME targets: identity/email RTO 4 hours, file shares RTO 8-24 hours, ERP RTO 24 hours, dev systems RTO 48-72 hours. Without targets, teams either overpay for gold backups everywhere or under-protect critical workloads.
2) 3-2-1-1-0 explained (and what teams miss)
3 copies of data (production + 2 backups).
2 different media (disk + object storage/tape).
1 copy offsite (different fault domain/account).
1 copy offline or immutable (cannot be altered for retention period).
0 errors (verified restores, not just backup completed).
3) Harden the backup platform like Tier 0
Separate backup admin accounts from domain admins; require MFA everywhere.
Limit console access to a management network or jump host.
Enable immutability on repositories; protect repository credentials.
Forward backup audit logs to SIEM (delete job, change repository, disable immutability).
4) Immutable object storage example (AWS S3 Object Lock)
S3 Object Lock (illustrative)
aws s3api create-bucket --bucket company-backup-immutable --region us-east-1
aws s3api put-object-lock-configuration --bucket company-backup-immutable --object-lock-configuration "ObjectLockEnabled=Enabled,Rule={DefaultRetention={Mode=COMPLIANCE,Days=30}}"5) Recovery drills: the KPI that matters
Schedule drills quarterly. Perform real restores: file-level restore, VM restore, and one application-consistent database restore. Track time-to-restore and failure reasons. The goal is to make restoration boring and repeatable.
Measured outcome from a 2-site org (~60 VMs + M365): after immutable offsite copies and quarterly drills, full file server restore time went from an estimated 2 days (never tested) to a measured 6 hours including permission validation.
Want this level of engineering on your product?
PharmoTech builds high-performance web apps, mobile apps, desktop apps, and supports growth with branding + marketing.