When Aggasys responds to data loss incidents in Singapore, the conversation almost always follows the same pattern. The business owner says: "We have backups." Then we ask: "When did you last restore from them?" The room goes quiet.
Having a backup and having a working backup are two different things. In 2024, Singapore recorded a 21% rise in ransomware cases according to the CSA's Cyber Landscape report — and ransomware attacks do not just encrypt your data, they often target your backups first. If your backup strategy does not account for that, what you have is not a backup. It is a false sense of security.
This guide explains what a robust backup architecture looks like for a Singapore SME, how much it costs, and what "the 3-2-1 rule" means in practice — not just in theory.
Why Most Singapore SME Backup Strategies Fail
Before covering what good looks like, it helps to understand where most businesses go wrong.
Problem 1: Backups stored on the same network as production. A NAS drive in the server room that backs up your servers is better than nothing. But if ransomware hits your network, it will encrypt both the servers and the NAS. If the backup target is accessible from the same network as the machines being backed up, it is not a safe backup.
Problem 2: No offsite copy. A fire, flood, or physical theft at your server room or office destroys both your primary data and your onsite backup simultaneously. Singapore offices are modern, but server rooms in Ubi, Tuas, and older industrial estates are not designed as disaster-proof environments.
Problem 3: Backups that run but are never tested. Backup software reports success. Restore has never been attempted. When a restore is needed, the backup turns out to be corrupted, misconfigured, or missing critical data because the scope was never set up correctly.
Problem 4: Reliance on Microsoft 365 or Google Workspace as a backup. M365 and Google Workspace have a recycle bin and version history — but these are not backups. The recycle bin empties after 30–93 days depending on configuration. Deleted data beyond that window is gone unless you have a third-party backup tool. Accidental mass deletion, departing employee data wiping, and ransomware that syncs encrypted files to cloud drives are all real scenarios M365's native tools do not protect against.
Problem 5: RPO and RTO are undefined. See the companion article on disaster recovery — but in short: if you do not know how much data loss your business can tolerate (RPO) and how long recovery can take (RTO), you cannot design a backup strategy to meet those requirements.
The 3-2-1 Rule: What It Means and Why It Works
The 3-2-1 backup rule is the foundation of every robust backup strategy. It is simple:
- 3 copies of your data
- 2 different storage media types
- 1 copy offsite
3 copies: Your production data counts as copy 1. A local backup (NAS, backup server, or external drive) is copy 2. A cloud or offsite backup is copy 3. Three copies means two consecutive failures — hardware failure plus backup failure — are required to lose data.
2 different media types: This reduces the risk of a single-type failure taking out all your copies. For example: primary data on an SSD-based server (copy 1), local backup on a NAS with spinning hard drives (copy 2), cloud backup on object storage such as AWS S3 or Azure Blob (copy 3). Two of those three copies are on fundamentally different media.
1 copy offsite: At minimum one copy must be physically separate from your office. Cloud backup satisfies this. A tape or drive sent to a different location also satisfies this. The key is: a single physical event at your office cannot destroy all your copies.
The 3-2-1 rule has been extended in recent years to 3-2-1-1-0:
- Additional 1: one copy must be offline or air-gapped (not accessible via network) — this is the ransomware protection layer
- 0: zero errors on backup verification — every backup must be tested to confirm it is restorable
What "Immutable Backups" Means and Why You Need Them
Ransomware groups have evolved. Modern ransomware attacks do not just encrypt your production data — they actively seek out and attempt to delete or encrypt backup targets on the network. This is why the "1" in 3-2-1-1-0 matters: an air-gapped or immutable copy that ransomware cannot reach.
Immutable backup means backup data that cannot be modified or deleted for a defined period — even by an administrator account. Cloud storage providers including AWS S3, Azure Blob, and Backblaze B2 offer object lock features that make backups immutable for a retention period you define.
If ransomware hits your systems and your cloud backup is immutable with a 30-day retention window, the attacker cannot delete your backups — they are locked. Your recovery point is the last clean backup before the infection, and you restore from that.
For Singapore SMEs, implementing immutable cloud backup adds minimal cost (storage pricing is the same; the lock feature is typically included) but fundamentally changes your ransomware resilience posture.
Backup Architecture Options for Singapore SMEs (With SGD Costs)
Option 1: Local NAS + Cloud Backup (3-2-1 Compliant)
What it is: Servers and endpoints back up to a local NAS device. The NAS then replicates to a cloud backup service. Two copies exist locally (production + NAS) and one in the cloud.
Best for: Businesses of 10–50 users with moderate data volumes (under 5TB).
| Component | Monthly Cost (SGD) |
|---|---|
| NAS hardware (amortised over 5 years) | 80–200 |
| NAS backup software (e.g., Synology Backup) | Included or 50–150 |
| Cloud backup storage (1–5TB, e.g., Wasabi, Backblaze) | 50–200 |
| Managed monitoring and restore testing | 300–600 |
| Total | 430–1,150/month |
Limitation: Local NAS is on the same network — needs ransomware-safe configuration (isolated VLAN, immutable snapshots) to avoid being a single point of failure.
Option 2: Backup-as-a-Service (BaaS) — Cloud-Primary
What it is: Agent-based backup software (Veeam, Acronis, Datto, Commvault) backs up servers, workstations, and M365 to the cloud directly. No local NAS required. For recovery, data is pulled from cloud.
Best for: Cloud-first businesses, companies with M365/Google Workspace reliance, businesses where local restore speed is less critical than simplicity.
| Component | Monthly Cost (SGD) |
|---|---|
| BaaS subscription (per workload/server) | 150–400 per server |
| M365/Google Workspace backup | 5–15 per user |
| Managed monitoring and restore testing | 200–500 |
| Total (example: 5 servers, 50 users) | 1,300–3,250/month |
Limitation: Cloud-only restore is slow for large datasets. Restoring 5TB from the cloud can take days. Consider local copy or instant recovery options if RTO is under 8 hours.
Option 3: Hybrid Backup (3-2-1-1-0 Compliant)
What it is: Local appliance (physical or virtual) for fast local recovery combined with cloud replication for offsite protection. Air-gapped immutable cloud copy for ransomware protection. M365/Google Workspace covered by dedicated backup.
Best for: Businesses of 30–150 users with mixed on-premise and cloud environments, businesses with defined RTO requirements under 4 hours, regulated industries.
| Component | Monthly Cost (SGD) |
|---|---|
| Local backup appliance (amortised over 3 years) | 300–800 |
| Backup software licensing (Veeam/Datto) | 400–1,200 |
| Cloud storage — primary (5–20TB) | 150–600 |
| Cloud storage — immutable offsite copy | 100–400 |
| M365/Google Workspace backup | 5–15 per user |
| Managed monitoring, quarterly restore tests | 500–1,000 |
| Total (example: 50 users) | 1,700–4,250/month |
Benefit: Sub-4-hour RTO from local appliance for most scenarios. Ransomware resilience via immutable copy. Full coverage across on-premise and cloud workloads.
Microsoft 365 Backup: The Gap Most Singapore SMEs Don't Know They Have
Microsoft 365 is not a backup platform. Microsoft makes this clear in their Shared Responsibility Model: Microsoft is responsible for the infrastructure; you are responsible for your data.
What M365 provides natively:
- Recycle bin: 30–93 days depending on configuration
- Version history: limited history for SharePoint/OneDrive files
- Litigation hold: available but complex to configure and not a restore tool
What M365 does not protect against:
- Accidental deletion beyond the recycle bin window
- Ransomware syncing encrypted files to OneDrive (the encrypted versions overwrite the good versions)
- Departing employee accounts being purged (data deleted on licence removal)
- Malicious deletion by an insider with admin rights
- Licensing changes that inadvertently remove data access
A dedicated Microsoft 365 backup solution (Veeam M365, AvePoint, Acronis, Backupify) backs up Exchange Online, SharePoint, OneDrive, and Teams to a separate storage location with daily backups and point-in-time restore capability. Cost for Singapore SMEs: SGD 5–15 per user per month — typically SGD 250–750/month for a 50-person company.
Given that M365 is now the operational backbone for most Singapore SMEs, this is not optional protection.
What We Typically See When We Audit Backup Infrastructure
When Aggasys conducts a backup audit as part of a new client onboarding, we consistently find:
Backup scope gaps. The backup job was configured for the main file server but not for the accounting software database, email archive, or M365. Critical data was assumed to be backed up but was not in scope.
Never-tested restores. The backup software shows daily successful jobs. The last restore test — if it ever happened — was during the initial setup, years ago. We have found cases where backup jobs were running but the backup destination was full; new data was not being backed up, but the alerts were not configured to notify anyone.
On-premise-only backups. Backups exist on a NAS in the server room, which is in the same building as the production servers. One physical event takes everything.
No M365 backup. The assumption was that Microsoft backs up M365. This is a very common misunderstanding.
Undefined retention periods. Backups exist but no one has defined how long to keep them. Either the backup target fills up and old backups are deleted automatically, or backups accumulate indefinitely with no review.
Backup Testing: The Step That Cannot Be Skipped
A backup that has not been tested is a theory. Restore testing must be a scheduled, recurring activity — not something done only when a disaster actually occurs.
What restore testing should cover:
- At minimum quarterly: restore a representative sample of files from each backup type to a test environment. Verify the files are intact and readable.
- At minimum annually: conduct a full server restore from backup to a separate environment. Validate that the restored system is functional, that all data is present, and that the restore time matches your RTO target.
- After any major change: adding new servers, changing backup software, expanding to a new site, changing cloud storage providers — each change should trigger a restore test.
Restore test results should be documented: what was tested, when, how long it took, and any issues found. This documentation is increasingly expected by cyber insurance underwriters in Singapore, who ask about backup practices as part of policy assessment.
Backup and PDPA: What Singapore Businesses Must Know
Under the PDPA Protection Obligation, organisations must implement reasonable security arrangements to protect personal data. This extends to backup practices.
The PDPC has found in enforcement decisions that:
- Backups without encryption are inadequate protection for personal data, particularly if stored in third-party or cloud environments
- Data retention policies must extend to backup copies — if you are required to delete personal data at the end of a retention period, you must also delete it from all backup copies
- Third-party backup providers must be assessed under your PDPA third-party management obligations
Practically, this means: encrypt your backups (at rest and in transit), document your backup retention periods alongside your data retention policy, and ensure your backup service agreement includes appropriate data protection clauses.
Frequently Asked Questions
What is the 3-2-1 backup rule?
The 3-2-1 rule means keeping 3 copies of your data, on 2 different storage media types, with 1 copy offsite. Your production data is copy 1, a local backup (NAS or backup server) is copy 2, and a cloud or offsite backup is copy 3. Using two different media types — for example SSD production storage, spinning-disk NAS, and cloud object storage — means a single-type failure can't take out all your copies at once. The rule has since been extended to 3-2-1-1-0, adding one air-gapped or immutable copy for ransomware protection and requiring zero errors on backup verification testing.
How much does business data backup cost in Singapore?
For a Singapore SME, a Local NAS + Cloud Backup setup (3-2-1 compliant) runs SGD 430–1,150/month for 10–50 users with moderate data volumes. A cloud-primary Backup-as-a-Service setup runs roughly SGD 1,300–3,250/month for 5 servers and 50 users. A full Hybrid architecture (3-2-1-1-0 compliant, with immutable offsite copy and sub-4-hour RTO) runs SGD 1,700–4,250/month for around 50 users. Microsoft 365 backup specifically adds SGD 5–15 per user per month, or roughly SGD 250–750/month for a 50-person company.
Does Microsoft 365 include backup?
No. Microsoft's Shared Responsibility Model is explicit: Microsoft is responsible for the infrastructure, and you are responsible for your data. M365 natively provides a recycle bin (30–93 days depending on configuration) and limited SharePoint/OneDrive version history — neither is a backup. These native tools don't protect against deletion beyond the recycle bin window, ransomware that syncs encrypted files over the good versions in OneDrive, data wiped when a departing employee's licence is removed, or malicious deletion by an admin account. A dedicated M365 backup tool (Veeam M365, AvePoint, Acronis, Backupify) is needed to close this gap.
What are immutable backups and why do they matter?
An immutable backup is data that cannot be modified or deleted for a defined retention period — even by an administrator account. This matters because modern ransomware doesn't just encrypt production data; it actively seeks out and tries to delete or encrypt backup targets on the network. If your cloud backup is immutable with, say, a 30-day retention lock (available via object lock features on AWS S3, Azure Blob, or Backblaze B2), an attacker cannot delete it. Your recovery point is simply the last clean backup before the infection. For Singapore SMEs, adding immutability typically costs little extra since the lock feature is usually included with the same storage pricing.
How often should backup restores be tested?
At minimum quarterly for a representative sample of files across each backup type, and at minimum annually for a full server restore to a separate environment to confirm the system is functional and the restore time matches your RTO target. A restore test should also be triggered after any major change — new servers, a change of backup software, a new site, or a new cloud storage provider. Results should be documented, since cyber insurance underwriters in Singapore increasingly ask about backup and restore-testing practices during policy assessment.
Book a Free Backup Audit with Aggasys
Aggasys provides comprehensive backup audits for Singapore SMEs — reviewing your current backup coverage, testing restore capability, identifying gaps in scope or protection, and recommending the right architecture for your data volume and RTO/RPO requirements.
Book your free backup audit: aggasys.com/contact or call (+65) 6250 0045.