Guide
Backup: why it is vital, and when to hand it over
Without a usable backup, a failure or ransomware brings the business to a halt. This guide explains why the subject belongs to senior management, the questions to ask, and when to entrust backup to a specialist.
Updated on 18 October 2026 · Figures are sourced at the bottom of the page; the assessments are IT CyberWall’s own.
Why it is vital
A disk failure, a handling error, a stolen computer, a fire or ransomware: without a usable backup, the business stops. And attackers know it. In the Veeam 2023 study (1,200 organisations, nearly 3,000 cyber attacks), 93% of attacks also targeted backups; in 75% of cases, some of the backup repositories were lost[1].
Online services do not exempt you from this. Microsoft itself writes in its services agreement: “We recommend that you regularly backup Your Content and Data”[2]. See also our guide Microsoft 365 and Google Workspace do not keep your data for you.
Five questions to ask yourself
You do not need to know how backups work to know whether you are protected. The French authorities agree on a few principles, which translate into simple questions:
- Is there a copy outside our premises? The CNIL recommends keeping one at a geographically distant site[3].
- Is one copy out of reach of ransomware? The CNIL asks for at least one backup to be isolated from the network[3]; ANSSI details the options in its guide to backup fundamentals[4].
- Can a hacker who takes over our usual accounts delete our backups? ANSSI recommends backup administration accounts that are separate from production accounts[4].
- Have we ever actually restored? The CNIL and ANSSI call for regular restore tests[3][4]. A backup that has never been tested is a promise, not a guarantee.
- How much downtime and how much data loss can we accept? This is a management decision, not a technical setting: see our guide how much downtime and data loss your business can accept.
If you answer “I don’t know” to any of these questions, it is time to hand over.
When to hand it over
A few situations where you should not wait:
- your backups rely on a USB drive or a NAS kept on your premises;
- nobody receives an alert when a backup fails;
- your email and files are in Microsoft 365 or Google Workspace, with no independent backup;
- you are changing server, host or IT provider;
- your insurer or a customer asks you to prove your backups;
- you have just suffered an incident.
Backup design, copy frequency, retention period, immutability and restoration tests are the job of a backup provider. WeDoBack details them in its IT backup guide.
Who does what
| IT CyberWall | WeDoBack |
|---|---|
| Inventories what needs protecting: servers, workstations, applications, email. | Operates the backup: copies, encryption, retention, immutability. |
| Designs the server architecture so that servers can be backed up and restarted. | Operates restoration and business recovery. |
| Monitors that backups are running and alerts you if one fails. | Organises restoration tests. |
The two contracts are separate: operations with IT CyberWall, backup with WeDoBack.
Can’t answer these five questions?
We inventory what needs protecting and put you in touch with WeDoBack for the backup.
Sources
Sources consulted on 18 October 2026. Supplier prices are shown excluding tax, in the currency and region of the published price list, and may change: always check the official page before deciding.
- Veeam – 2023 Ransomware Trends Report, press release of 23 May 2023 — www.securityinfowatch.com/cybersecurity/press-release/53061422/veeam-veeam-research-finds-93-of-cyberattacks-target-backup-storage-to-force-ransom-payment
- Microsoft – Microsoft Services Agreement, section 6.b — www.microsoft.com/en-us/servicesagreement
- CNIL – Sécurité : Sauvegarder — cnil.fr/fr/node/1433
- ANSSI – Sauvegarde des systèmes d’information, les fondamentaux (25 October 2023) — messervices.cyber.gouv.fr/documents-guides/anssi_fondamentaux_sauvegarde_systemes_dinformation_v1.1.pdf
Backup and restoration are operated by WeDoBack.