Why backups fail (the 3 most common reasons)
Across hundreds of SMB incidents in the Balkans, backups fail for the same three reasons — over and over. Most businesses learn this the hard way, on the day they need the backup most.
If your backup strategy doesn't address all three, it's not really a backup strategy. It's a hope.
Reason 1: Only one copy exists. A single drive failure, ransomware encryption, or accidental deletion destroys both the original and the backup simultaneously.
Reason 2: The offsite copy doesn't exist. Fire, flood, theft — or simply a server room power surge that fries every connected device — takes out the primary and the backup.
Reason 3: The restore has never been tested. Backups that 'look successful' are sometimes incomplete, sometimes corrupted, sometimes encrypted by a ransomware that sat dormant for months. You only know when you try to restore.
The 3-2-1 rule, plain English
Three copies of your data, on two different media types, with one copy off-site. That's 3-2-1. It's been the industry standard since the 1980s, and it's still the foundation of every modern backup strategy.
- 3 copies: your live data + two backup copies
- 2 media types: e.g., disk + cloud, or disk + tape
- 1 off-site: at least one copy stored somewhere physically separate from your primary site
Why 3-2-1-1 is the new minimum
Modern ransomware attacks backup software too. If your offsite copy is just another backup server, the attacker — once they compromise your admin account — can delete or encrypt it. The fix: make one copy immutable. Immutable means it cannot be modified or deleted within a defined periudhë ruajtjeje, even by an admin.
Object lock on S3-compatible cloud storage (AWS S3, Backblaze B2, Wasabi, MinIO) is the most cost-effective way to achieve immutability for SMBs. Acronis, Veeam and Datto all support immutable cloud targets natively.
Where to keep your offsite copy
For an SMB in Kosovo, three sensible options exist:
- EU data centre (Frankfurt, Amsterdam, Vienna): best for GDPR / LPD compliance, fast restore times
- Kosovo data centre (local provider): best data sovereignty, lower latency, supports local economy
- Multi-region cloud (AWS Frankfurt + AWS Dublin): best disaster resilience, slightly higher cost
For most SMBs, an EU or Kosovo data centre with immutable cloud storage is the right balance of cost, compliance, and recoverability.
How often to test restores (and how)
Test monthly for critical systems (file server, M365, ERP). Test quarterly for everything else. The test must be a full restore to a clean device — not just opening a backup file. Anyone who says 'the backup is verified by checksum' and has never actually restored a file is not verifying the backup.
Document every test: date, what was restored, time to restore, any errors. If your provider can't show you a recent test restore log, the backup is not real.
Backup tools compared
Common backup solutions for SMBs
| Tool | Best for | Cloud immutability |
|---|---|---|
| Veeam | Servers + cloud workloads | Yes (native) |
| Acronis Cyber Protect | All-in-one (backup + EDR) | Yes (native) |
| Datto SIRIS | SMBs with managed provider | Yes (built-in) |
| Windows Server Backup | Tiny SMBs on budget | No (no immutability) |
| Native cloud (M365) | M365 only | Po (politika të ruajtjes) |
Retention: how long to keep backups
Daily backups for 30 days, weekly for 12 months, monthly for 7 years — kërkesat tipike të ruajtjes tatimore in Kosovo. Adjust upward for regulated industries (finance, healthcare, legal). Adjust downward only if you're certain no compliance applies to your data.