Clear Path step · Business · Open for business on Monday
Back up the cloud too, and prove you can restore
There's a copy of your email and files that a stolen admin account can't delete, and you've proved it restores.
Why it matters: Ransomware and data extortion now target cloud accounts as well as computers, and an attacker with admin access can delete synced files and recycle bins. A copy they can't reach is what lets you reopen on Monday.
Best after: Name an owner and map what you'd lose
Do it
- Confirm what your email and file platform keeps, for how long, and whether that's enough.
- Add a backup that covers mailboxes and shared drives, held under separate credentials.
- Make at least one copy immutable or offline.
- Restore a file, a folder and a mailbox each quarter; time it and write the steps down.
- Back up the backups' sign-in details offline.
Say this: If files go missing or get locked, we restore from the copy we've already tested.
Check it worked: Company files, email and key systems are backed up, including Microsoft 365 or Google Workspace data, one copy can't be deleted from a stolen admin account, and someone restored a real file and mailbox this quarter.
If an outside IT company handles your IT, send them this:
Hi, could you please tell us what our email and file platform keeps and for how long, then back up our mailboxes and shared drives using credentials separate from our Microsoft 365 or Google admin accounts, so a stolen admin login can't delete them? We'd like one copy immutable or offline, and a quarterly restore of a file, folder and mailbox. Please confirm when we can run the first.
Simply put
It's like keeping a copy of the company records in a different building, under a different key. If someone steals the admin login and deletes everything in the cloud, that copy is still there, and you've already practiced using it.
In detail
Many groups now steal data before encrypting it, so backups solve the outage but not the disclosure. That's why b-data-minimize sits in the same path: data you no longer hold can't be held for ransom.
As a story
Saturday morning, your office manager texts: the shared drive is empty. Someone got into an admin account overnight and deleted the synced files and the recycle bin.
It's unsettling, but you've practiced this. Your backup sits under separate credentials, with one copy that can't be deleted from a stolen admin account, and the restore steps you timed last quarter are written down.
You and your IT provider lock the admin account, sign the intruder out and check the other admins. Then you restore the shared drive and key mailboxes, most-needed first. On Monday people open their files as usual, and you set about finding out how they got in.
Points toward the Long View: a business that can reopen from a copy attackers can't reach.