How to Choose a Cloud Backup Provider

A Croydon accountancy firm rang us on a Monday. Over the weekend a member of staff had opened an invoice attachment that wasn’t an invoice, and by Monday morning ransomware had worked its way through the shared drive. The files were encrypted and useless. The good news was that they had a backup. The bad news was that nobody had ever tested it, the most recent clean copy was eleven days old, and it took most of the week to get everything back. They survived — but it was a bad week that a better backup would have made a quiet afternoon.

That gap, between “we have a backup” and “we can actually recover”, is the whole subject of this guide. Plenty of businesses across South London and Surrey pay for cloud backup and assume they’re covered. Choosing well means looking past the monthly price at four things that decide whether a backup saves you or lets you down: retention, recovery speed, ransomware protection and testing.

Retention: how far back can you go?

Retention is how long your backups are kept and how many recovery points you have. It matters more than people expect, because the worst data problems are the ones you don’t notice straight away.

A file gets corrupted, an important spreadsheet is quietly overwritten, or a slow ransomware infection sits for a fortnight before it triggers. If your backup only holds the last seven days, and the problem started three weeks ago, every recovery point you have is already broken. You’d be restoring the damage.

Look for a provider that keeps a sensible mix — frequent points over recent days, plus longer-term monthly copies you can reach back to. Ask the specific question: “If I discover a problem that started six weeks ago, can I recover a clean version?” If the answer is no, the retention is too short.

Recovery speed: how fast can you get working again?

Having a backup is only half the job. The other half is how quickly it turns back into a working business. This is where a lot of cheap backup falls down — the data is there, but getting it back takes days, and a business standing still for days is a serious cost.

Recovery speed depends on how much data you have, how it’s stored and whether there’s a plan for the order things come back in. A good backup and continuity setup treats this as a design question, not an afterthought: what must be running within an hour, what can wait until tomorrow, and who does what while it happens. Ask any provider roughly how long a full recovery would take for a business your size. Vague answers are a warning sign.

Ransomware protection: can the backup itself be attacked?

Ransomware has changed what a backup needs to do. Modern attacks deliberately hunt for backups and encrypt or delete them first, because a business with no backup has no choice but to pay. So a backup that’s simply connected to your systems, with the same logins, isn’t really protection — it’s another target.

What you want is backups that can’t be altered or deleted once written, kept separate from your main environment, with their own access controls. The industry term is “immutable”, and it’s worth asking for by name. This sits alongside your wider cyber security — the backup is your last line, the thing that lets you refuse to pay and recover on your own terms. If an attacker can reach it as easily as they reach your files, it isn’t doing that job.

Testing: has anyone proved it works?

This is the one that catches people out, because it’s invisible until the day you need it. A backup that has never been restored is a hope, not a plan. Configurations drift, jobs silently fail, and folders get missed — and none of it shows up until you try to recover and find the copy is incomplete or the process doesn’t work.

A serious provider tests restores on a regular schedule and can show you it works, rather than assuming a green tick in a dashboard means the data is genuinely recoverable. When something does go wrong and a backup turns out to be broken, the fallback is specialist data recovery — slower, costlier and never guaranteed. Regular testing is what keeps you out of that situation.

A quick checklist

Before you sign anything, get clear answers to these:

1. Retention — How far back can I recover, and are there longer-term monthly points, not just the last few days?
2. Recovery speed — Roughly how long to get my business working again after a full loss?
3. Ransomware protection — Are backups immutable and separated from my main systems and logins?
4. Testing — How often are restores actually tested, and can you show me evidence?
5. Coverage — Is my Microsoft 365 data (email, SharePoint, OneDrive) backed up separately, not just my files and servers?
6. Who fixes it — When a recovery is needed at 8am on a Monday, who do I call, and what do they do?

If a provider answers those clearly and honestly, you’re in good hands. If they get vague — especially on testing and ransomware — treat that as your answer.

Getting it right for your business

Good backup isn’t about buying the most storage or the cheapest plan. It’s about being able to recover the right data, quickly, even after the worst kind of day — and knowing that because someone has tested it. If you’re not sure whether your current backup would stand up to a real incident, we’re happy to take a look, tell you honestly where the gaps are, and set up something you can actually rely on. No jargon, no scare tactics — just a backup that works when you need it.