Backups are the control everyone assumes is handled. The dashboard is green, a job runs every night, and the subject only comes up when something has already gone wrong. By then, the gap has done the damage.
Most businesses do have a backup of some kind. The problem is rarely that nothing is running. It is that the backup will not do the one job it exists for: getting you back to work quickly after a disaster, a ransomware attack, or the day a laptop dies with the only copy of something important. When we look properly, the same gaps appear again and again. They are not the result of carelessness, just the things that quietly never got finished or tested. This is the list.
Gap 1: Nobody Has Ever Tested a Restore
This is the one that keeps us up at night. Backups are running, the dashboard is green, and everyone assumes recovery is covered. Then an incident hits, someone tries to restore, and the files are incomplete, corrupted, or the job had silently failed weeks ago.
A backup you have never restored from is a guess, not a safety net. The fix is to test restores on a schedule, prove the data actually comes back, and keep a record that it worked. The testing is the part that counts, and it is the part most often skipped.
Gap 2: There Is No Immutable Copy
Modern ransomware looks for your backups first. If your backup can be reached and deleted from the network, an attacker encrypts your live data and your recovery copy in the same move, and the safety net is gone exactly when you need it.
The fix is at least one immutable copy: a backup that cannot be altered or deleted, even by someone with full access to your systems. It is the difference between recovering in hours and paying a ransom with no guarantee. Our guide to immutable backup explains how it works and why it matters.
Gap 3: Microsoft 365 Is Assumed to Be Backed Up
This is the most common and most dangerous assumption we see. Because email and files live “in the cloud”, owners assume Microsoft is backing them up. Microsoft keeps the service running, but it is not your backup. If data is deleted, whether by accident, a departing staff member, or ransomware, and the retention window passes, it is gone.
The fix is a proper third-party backup of your Microsoft 365 mail, files, and shared sites, kept separately and retained on your terms. It is one of the cheapest gaps to close and one of the most expensive to ignore.
Gap 4: There Is Only One Copy
A single backup is a single point of failure. If that one copy is corrupted, encrypted, or sitting on hardware that dies, you have nothing to fall back on. We regularly find businesses relying on one backup target and assuming it covers them.
The established answer is the 3-2-1 backup rule: three copies of your data, on two different types of storage, with one copy offsite. You do not need to memorise the theory. You need more than one copy, in more than one place, so a single failure never wipes out your recovery.
Gap 5: Backups Sit on an Always-Connected Drive
A backup drive that is plugged in and online all the time is convenient, and it is also reachable by anything that gets onto your network. Ransomware treats a connected backup drive as just another folder to encrypt.
The fix is separation. At least one copy should be offline, immutable, or held in a separate environment an attacker cannot touch from a compromised machine. A backup that is exposed to the same threat as your live data is not really a backup, it is a second victim.
Gap 6: There Is No Documented Recovery Target
Most businesses have never answered two simple questions: how much data can we afford to lose, and how long can we afford to be down. Without those answers, a backup is set up to “run”, with no standard for whether it is good enough.
Those two numbers shape everything: how often backups run, where they are kept, and how fast you can recover. The fix is to decide them deliberately, write them down, and make sure the backup setup actually meets them. It turns backup from a vague comfort into a defined safety net you can rely on.
Gap 7: Nothing Is Held Offsite
If every copy of your data lives in the same building, a single physical event can take all of it: fire, flood, theft, or a hardware failure that hits the lot. We still find businesses whose only backup sits on a drive next to the server it is meant to protect.
The fix is an offsite copy, kept somewhere a local disaster cannot reach. Cloud backup makes this straightforward, but it has to be set up and verified, not assumed. Offsite is the copy that saves you on the worst day, the one where the office itself is the problem.
Closing the Gaps
None of these are exotic. They are the everyday shortfalls that turn a recoverable incident into a closed business. Most are a matter of configuration, separation, and testing, not a major rebuild, and several use tools you may already be paying for.
The hard part is knowing which ones apply to you, because a backup looks fine right up until the moment you need it. That is the value of an honest assessment.
Where to Start
If you recognised your business in more than one of these, you are normal, and you are also in a good position, because every gap on this list has a clear fix.
Start by getting a clear picture of where you stand. Our IT maturity assessment takes a few minutes and shows you which controls need attention first.
We are a Sydney-based team in Bella Vista. We help businesses across the metro area put backups in place that actually recover them, with managed IT that treats recovery as something tested rather than assumed. No jargon, no scare tactics, just the basics done properly.
