When an Australian SME asks their IT provider if their data is backed up, the answer is often, "It's in the cloud." Under the harsh scrutiny of the Essential Eight, "just the cloud" is rarely enough to guarantee data recovery following a catastrophic ransomware event.
The Essential Eight Backup Requirements
To meet the criteria for regular backups, businesses must go significantly beyond standard file syncing (like OneDrive or Dropbox). Syncing is not backing up. If a ransomware variant encrypts your local files, the sync engine will happily upload the newly encrypted files to the cloud, destroying the copies.
What Does ML2 and ML3 Demand?
- Retention: Backups must be retained for at least 3 months, preventing slow-acting ransomware.
- Isolation (Air-Gapping): Backup data must be strictly isolated. An adversary who gains Domain Admin access and launches a ransomware attack must not be able to traverse the network and delete your backup repository.
- Testing: The most commonly failed component of an Essential Eight audit. Having a backup is useless unless you routinely test partial and full restorations to verify integrity.
Cloud-to-Cloud Backups
If your entire operation runs on Microsoft 365 or Google Workspace, you still need backups! You must implement a third-party cloud-to-cloud backup solution to snapshot mailboxes, SharePoint drives, and databases, protecting them against accidental deletion, malicious insiders, and sophisticated attacks.
Are your backups truly isolated and compliant? Run a quick evaluation using our Essential Eight Readiness Audit to ensure your business can bounce back.