Microsoft 365 backup — why it's essential

Shared responsibility model

Regulatory compliance is not optional — it is a condition for operating. For Polish companies in 2026 the three sets of requirements that matter most are: GDPR, NIS2 and (in selected industries) sectoral rules (e.g. KNF).

The minimum you need

• A record of processing activities and a risk analysis.
• Data Processing Agreements (DPA) with every provider processing personal data.
• An incident reporting procedure (72 hours to the DPA in case of a breach).
• A security policy and regular employee training.
• Backups with restore tests (proof that the backup works).

GDPR fines in Poland reach up to 4% of global turnover. NIS2 adds reporting duties and personal liability of the management. The cost of preparation is incomparably lower than the cost of being unprepared.

Risks

Modern IT security works in layers. No single solution protects a company 100% — only a full set of layers (identity, endpoints, network, data, people) provides real effect. In the context of Microsoft 365 backup — why it's essential it is worth starting with the basics:

• MFA on all accounts (no exceptions for the board — the most common gap).
• EDR/XDR instead of classic antivirus — it detects behaviour, not just signatures.
• Backups in several locations, including an offline or immutable copy — ransomware cannot encrypt them.
• Patches within 14 days of the vendor's release.
• Anti-phishing training at least quarterly, with simulations.

Backup vendors

Backup is not "copy a folder to an external drive". It is a defined process that specifies what, how often, where and for how long is copied — and how quickly it can be restored.

How many copies and where to keep them

• At least three copies of the data on two different media,
• one copy off-site (another office, cloud, colocation),
• one copy offline or immutable (ransomware-proof and safe from accidental overwrites),
• zero errors during the restore test.

That last point matters most — a backup that was never tested statistically fails to restore in 30–40% of cases at the critical moment. Quarterly restore tests are the standard we recommend to every client.

Price

A conversation about IT costs starts with a single question: what exactly are we buying?. In practice there are three types of billing: flat fee, hourly, and mixed (base + overage). Each makes sense in a different scenario.

• Flat fee — a predictable cost, best for companies with a stable number of users and systems.
• Hourly — flexible, but hard to budget for a whole year.
• Mixed — the base covers 80% of the work, overage is billed separately; the most common model in SMEs.

What to watch for in a quote

The rate alone is not everything. Check what exactly the price covers, what the hour cap is, how out-of-scope projects are priced and whether travel is billed. The gap between the cheapest and most expensive offer in Poland can be 3–4× — and it usually comes down to what is "in the price" and what is not.