Access, backups and continuity, without guesswork

Many companies do not feel they have a security problem until they need to recover a critical file, shut down the access of someone who left or keep working after an outage. That is when they find out that access, backups and continuity are not separate fronts: poorly controlled access is the door ransomware comes through, an untested backup is what keeps you from recovering, and continuity without owners is what turns a bad morning into a lost week.

This article walks through the three fronts with concrete controls, written for an organization without a dedicated security team.

Access: the risk starts before the attack

When a company grows fast, access gets granted for convenience. Shared accounts, permissions that are never removed, excessive privileges and vendors with open-ended access end up creating a much larger attack surface than the organization imagines.

The first control is not buying a new tool. It is being able to answer four questions for every important system: who gets in, with which permissions, who approved it and when it is reviewed.

Multi-factor authentication, no convenient exceptions

CISA’s #StopRansomware guide recommends phishing-resistant MFA for all services, particularly email, VPNs and accounts that access critical systems. Microsoft, for its part, states in its documentation on Entra ID security defaults that MFA and blocking legacy authentication stop more than 99.9% of the common identity attacks it sees.

That second point matters: older mail protocols (IMAP, POP3, SMTP with a password) do not support MFA, so leaving them open lets attackers bypass the protection even when it is on.

Access review checklist

• Remove shared accounts from critical processes; one user per person.
• Keep admin accounts separate from everyday accounts.
• Review inherited permissions and oversized profiles every quarter.
• Define onboarding, changes and offboarding with an owner and a deadline (offboarding on the person’s last day).
• Give vendors access with an expiry date and review it when each contract ends.
• Keep two documented, monitored emergency (“break glass”) accounts, as Microsoft recommends for its tenants.

Backups: having a copy is not enough

A backup is only worth something if it can be restored on time and complete. Many companies believe they are covered because some automatic copy exists, but they do not know how much would be lost, how long recovery takes or whether the key data is included.

Start with RPO and RTO

Two measures organize any backup conversation. NIST defines them in its contingency planning guide (SP 800-34): the RPO is the point in time to which data must be recovered after an outage, and the RTO is the overall time a system can be in recovery before it hurts the business.

In practice:

• RPO: how many hours of work you can afford to lose. If the answer is one hour, a daily copy will not do.
• RTO: how long you can be without the system. If it is four hours, restoring from a drive someone has to fetch from another office will not make it.

Setting them per service (billing, email, ERP, shared files) avoids backing up everything the same way and spending where it is not needed.

Copies out of reach, and restore tests

CISA recommends keeping offline, encrypted backups of critical data and regularly testing their availability and integrity in a recovery scenario. Many ransomware variants look for backups reachable from the network first, to encrypt or delete them.

Question	The answer you want
What does the copy cover?	The list of critical systems and data, not “the server”.
How often does it run?	A frequency that matches each service’s RPO.
Where does it live?	At least one copy off the main network or immutable.
When was it tested?	A recent full restore, with a date and a measured duration.
Who restores it?	A named person, and their backup.

Cloud services need backups too

In its Services Agreement, Microsoft recommends regularly backing up the content you store in its services. Recycle bins help, but they have limits: a deleted SharePoint site, for example, is kept for 93 days. If your operation runs on Microsoft 365 or Google Workspace, backing up that data is your decision. We cover it in what to check before migrating to Microsoft 365 or Azure.

Continuity: the right question is who decides

When an outage happens, the problem is rarely only technical. A coordination question shows up: who communicates, who prioritizes, what is recovered first and on what basis things get escalated. If that is not defined, the company loses time exactly when it most needs clarity.

A basic plan fits on two pages

• The list of critical services with their RTO and RPO.
• The person who decides and their backup, with a personal phone number.
• Contact paths that do not depend on the failed systems (if email is encrypted, it cannot be used to warn people).
• Recovery order: what comes back first and why.
• Vendors to call and what each one is contracted to do.
• Template messages for customers and staff.

Rehearse it once a year

A one-hour tabletop exercise with a concrete scenario (“the file server woke up encrypted”) reveals more gaps than any document. At the end, write down what was missing and who will fix it.

Common mistakes

• Turning on MFA for admins only and leaving everyone’s email on a password.
• Keeping the backup on a drive permanently connected to the same server.
• Trusting the backup because “the job finished without errors”, without ever restoring.
• Storing the continuity plan on the same server that goes down.
• Assuming the cloud provider backs up everything by default.

Where to start this week

If you can only do three things: turn on MFA for email and remote access, ask for a test restore of your most important system and write one page on who decides during an outage. With that, the organization can already explain how it prevents, how it recovers and how it decides under pressure.

If you want to do it with support, this is how we work on cybersecurity and continuity.