Backup & Disaster Recovery | Primetime IT Solutions

Why most backups fail

Most SMB backups break the day they’re actually needed.

After 20+ years of incident-response calls, the pattern is brutal. Backups that haven’t been tested, retention that doesn’t outlast ransomware dwell time, and the wrong assumption that “M365 is backed up by Microsoft.” (It isn’t — not the way you think.)

Backups encrypted alongside production
Backup server on the same domain, same credentials, same network. Ransomware reaches both. Without immutable copies, restore is theoretical.
Retention shorter than dwell time
Average ransomware dwell time is months. If you keep 30 days, the attacker has been backed up too. Restore brings the threat right back.
M365 has no real backup
Microsoft does service availability, not data backup. Retention is short. A malicious admin (or compromised one) can wipe mailboxes and SharePoint sites with no path back.
Restores never tested
Job status says “success” for years. The first real restore attempt hits a corrupted catalog, missing keys, or an expired license. The day you need it is the wrong time to find out.

Get Your Free Backup Audit →

The strategy

The 3-2-1-1-0 backup rule.

The post-ransomware update to the classic 3-2-1 rule. This is the floor — not the ceiling — for any environment that can’t afford to lose data.

Copies of every protected dataset — the primary plus two backups.

Different storage media. Disk + cloud. Disk + tape. Diversity defeats correlated failure.

Copy off-site. Geographically separated. Survives the building, the flood, the fire.

Copy immutable or air-gapped. Ransomware can’t encrypt what it can’t reach or rewrite.

Errors after restore verification. Tested means tested — not “backup completed”.

What we protect

Everything that matters — on-prem and cloud.

Veeam as the primary platform. Immutable repositories. Tiered retention. Tested restore playbooks per workload type.

M365 mailboxes

Daily granular backups. Mailbox, shared mailbox, archive. Point-in-time restore of single messages, calendar items, or full mailbox recovery.

SharePoint & OneDrive

Site-level, library-level, file-level restore. Versioning preserved. Permission metadata preserved. Useful when the version history has been weaponized by ransomware.

Teams chat & channels

Teams messages, channel posts, channel files, meeting recordings. Microsoft’s native retention is not a backup — this is.

On-prem servers

Windows / Linux VMs, Hyper-V, VMware. Image-based backups. Application-aware for SQL, Exchange, file servers. Instant recovery for rapid VM resumption.

Endpoints (where it matters)

Executive and high-risk-role workstations on continuous endpoint backup. OneDrive-known-folder-move covers the rest, plus the security stack we deploy.

Immutable repositories

Object-lock cloud storage, hardened Linux repos, S3-compatible immutable buckets. Cannot be encrypted, cannot be deleted before retention expires, even by an admin.

Tiered retention

30-day fast restore. 12-month standard. 7-year cold archive for regulated data. Tuned per industry and per workload — not a one-size-fits-all 30-day window.

Tested restore playbooks

Quarterly tabletop restores. Random mailbox, random file, random VM. Time-to-recover logged. Playbooks updated when something changes. Repeatable, not heroic.

DR runbook

Written, owner-approved, kept off-network. Roles, sequencing, contacts, vendor escalation paths. Reviewed annually. Ready when the power goes out.

Why this matters more in 2026

Ransomware groups now use AI to find your backups first.

Modern ransomware operators don’t just encrypt — they hunt. AI-assisted reconnaissance maps your environment, finds your backup server, exfiltrates data for double-extortion, then encrypts. If your backup architecture isn’t immutable and segmented, it’s the first thing they break.

Immutable means immutable
Object-lock or hardened Linux repositories that even a domain admin can’t delete. The backup an attacker can’t reach is the one that gets you back online.
Segmented backup network
Backup traffic on a separate VLAN. Separate credentials. Separate MFA. The blast radius of a compromised production environment stops at the backup boundary.
Restores tested before they’re needed
Quarterly tabletop restores against random workloads. We log the time-to-recover so when the real incident hits, the RTO isn’t a guess.

Pair with Cybersecurity Stack →

“A backup you haven’t restored from is just a file. The job status is ‘hope’ until you’ve actually pulled the data back.”

Laz De La Vega · Practice Lead, Primetime IT Solutions

Common questions

What we get asked on every backup call.

Doesn’t Microsoft back up M365 already?

No — not the way you need them to. Microsoft provides service availability and short-term recoverable items, but not point-in-time backup of mailboxes, SharePoint, Teams chats, or OneDrive in the form needed for ransomware recovery, legal discovery, or accidental deletion months after the fact. The Microsoft Shared Responsibility Model puts data protection on you.

What’s your RTO and RPO?

Depends on workload. M365 mailboxes typically restore in minutes for a single mailbox, hours for the whole tenant. Critical on-prem VMs — under an hour to running state with Veeam instant recovery. We’ll define explicit RTO/RPO targets per workload in your DR runbook based on what the business actually needs.

Where does the backup data live?

Primary backups typically on a local hardened repository (fast restore). Off-site copies replicated to an immutable cloud repository (object-lock S3-compatible storage, or Wasabi / Azure Blob with immutability). Data stays in U.S. regions unless specifically requested otherwise.

How often do you actually test restores?

Quarterly tabletop restores per client. We pick a random workload (mailbox, SharePoint site, VM), restore it, log the recovery time, and document any deviations. Annual full DR exercise for clients with formal DR requirements. Results land in your QBR.

What if we’ve already been hit?

Call — we’ll triage. If you have any backup at all, even from a third party, we can usually assist with isolating the environment, validating restore points, and starting recovery in parallel with whoever’s running formal IR. Backup recovery is one of the highest-leverage moments to engage an MSP that knows what it’s doing.

Backups that survive the worst day of your year.