We verify restores on a schedule, keep copies out of reach of the systems they protect, and write down what recovery actually looks like.
It's that nobody checked. The job reports success while silently skipping the one folder that mattered, or it has been failing for months and the alert goes to an address belonging to somebody who left the company. We've walked into exactly this. So we verify restores on a schedule and route alerts to a person who will act on them.
Microsoft and Google keep the service running. Both have retention features, and on the right license they will hold data for a long time. What neither does is put a copy outside the thing being protected. That is the difference that matters when the problem is the platform itself rather than one deleted file. If someone deletes a shared drive, or an account is compromised and files are encrypted through the sync client, what you can get back depends entirely on settings somebody chose a long time ago. We run independent backups of Google Workspace and Microsoft 365 into storage we control, which a lot of providers don't do at all.
Modern ransomware looks for the backups first. If ransomware on a domain-joined server can reach the backup, it will. We keep copies offline, or behind separate credentials the production environment can't reach, so there's something to come back from.
How long until you're working again, what you'd lose, which system comes up first, who calls the staff. We write that down for your environment and keep it current, so the decisions are already made before the morning you need them.
Most people learn the answer on their worst day. Better to learn it on a quiet Tuesday.
Start a Conversation