# Backup concept and tested recovery: the single most effective measure > Backups that hold when it matters: derive the requirements from the business, keep separate and immutable copies, test recovery regularly and document the evidence. URL: https://techport.ai/en/it-beratung/sicherheit-und-resilienz/backup-und-wiederherstellung --- 1. [IT Consulting](/en/it-beratung)/ 2. [Security and Resilience](/en/it-beratung/sicherheit-und-resilienz)/ 3. Backup and recovery [Security and Resilience](/en/it-beratung/sicherheit-und-resilienz) # Backup and recovery By Redaktion techport.ai, IT-Beratung · Last updated on 21 August 2026 Almost every company has a backup. Considerably fewer have a tested recovery. The difference shows exactly once, and then it costs weeks. Backups can be incomplete, they can sit on the same system that was encrypted, they can be reachable with the same credentials the attacker stole, and they can be technically flawless and still hold the wrong state. Recovery is the part that counts. Everything else is preparation for it. ## How you notice it * The last full recovery was more than a year ago or has never happened. * The backup is reachable over the same network and with the same accounts as the production systems. * It is unclear how long a full recovery would take. * New systems went live without anyone adjusting the backup. ## Why this happens Backup is set up and runs, and as long as the success message arrives everything looks fine. That message, however, only says that data was written, not that it is complete, consistent and restorable. A real test costs time and an environment in which you can restore without disturbing operations. Both are scarce in daily work, which is why the test gets postponed, often for years. ## How we go about it 1. **Derive the requirements from the business.** We determine per system how much data loss is tolerable and how quickly it has to be available again. Only those two figures decide the frequency, retention and technology of the backup. 2. **Establish separation and immutability.** We ensure that at least one copy sits outside the production network with its own credentials, and that one version cannot be altered or deleted for a defined period. That is exactly what attacks fail on. 3. **Check completeness.** We reconcile the backup against the system list, including configurations, directory service, virtual environments and systems operated externally. Cloud services generally back up their infrastructure, not your content. 4. **Test recovery and document it.** We restore regularly in a separate environment, measure the time required and document the result. That documentation is the evidence insurers, customers and auditors ask for. ## What you gain * Certainty that recovery works, rather than the assumption. * A solid figure for the duration that feeds into emergency planning. * Protection against the most common emergency, in which backups are attacked deliberately. ## From our projects In the first recovery test, at least one component is regularly missing that nobody had on the list. Most frequently these are network device configurations, certificates, licence keys and the systems needed to manage the backup itself. If that management exists only inside the affected environment, recovery is blocked before it starts. The second reliable finding concerns cloud services: many companies assume the provider backs up their content. For the availability of the platform that is usually true, for accidentally deleted or encrypted content frequently not, or only for a short window. ## Häufige Fragen How many copies do we need? A proven rule is to keep at least three copies of the data on at least two different media types, one of them off site and one that is immutable or physically separated. More important than the exact number is that one copy cannot be reached with the credentials of the production environment. How long do we have to keep backups? Backups serve recovery, not archiving, and a few weeks to months is usual. Retention obligations under commercial and tax law are met through archiving, not through backup. That separation matters, because otherwise either deadlines get breached or backups grow over years without anyone still being able to restore them. ## Let us talk about Backup and recovery In a thirty minute first call we work out where your biggest lever sits and whether we are the right people for it. [Arrange an initial call](/en/kontakt)[Our consulting](/en/so-funktionierts) ## Further reading [Security and ResilienceEmergency management and recoveryWhat happens when IT stops: determine critical processes and time targets, write the emergency plan, rehearse recovery, settle crisis communication and learn from exercises.](/en/it-beratung/sicherheit-und-resilienz/notfallmanagement)[Operations and SupportPlanning IT infrastructureInfrastructure that carries: plan capacity and replacement ahead, size network and sites, make dependencies visible, set maintenance windows and keep outages manageable.](/en/it-beratung/betrieb-und-support/it-infrastruktur)[Data and InformationDocuments and archivingStore documents so they can be found and stand up to audits: define the filing structure, implement retention periods, write the process documentation, order permissions and enable search.](/en/it-beratung/daten-und-information/dokumentenmanagement)[KnowledgeIT metricsDefinitions and formulas read the same way across the company.](/en/it-beratung/kennzahlen)[KnowledgeIT maturity checkKnow where your IT stands in ten minutes.](/en/it-beratung/reifegrad-check) Back to the field [Security and Resilience](/en/it-beratung/sicherheit-und-resilienz) Rt Written by [Redaktion techport.ai](/ueber-uns), IT-Beratung Mehr als 15 Jahre Erfahrung in IT-Projekten des Mittelstands, Auswahl und Einführung von Unternehmenssoftware, Aufbau von IT-Betrieb und Informationssicherheit in wachsenden Organisationen. [More about us](/en/ueber-uns) More from techport.ai [ Software Custom process software for mid-sized companies. ](/en/loesungen)[ HR consulting People processes and the systems behind them. ](/en/hr-beratung)[ IT maturity check Ten minutes to a clear position. ](/en/it-beratung/reifegrad-check)[ HR maturity check 24 statements, a result per field. ](/en/hr-beratung/reifegrad-check)[ Funding BAFA grant plus more than 50 programmes for delivery. ](/en/foerderung)[ Process in practice How workflows become reliable software. ](/en/sop-praxis)[ Data and AI Analysis, forecasts and assistance systems. ](/en/daten-ki)[ About us The people behind techport.ai. ](/en/ueber-uns)