The budget for an outsourced backup for an SME in Geneva depends mainly on the volume of data, their frequency of modification and the desired restoration time. It must therefore correspond to your operational needs, rather than an identical formula for all companies. For an outsourced backup of SMEs in Geneva, the main thing is to protect critical data while allowing it to be easily recovered.
You are right to look beyond storage space: an unusable copy at the time of an incident does not protect your business. The 3-2-1 model helps structure protection: three copies of data, on two different media, including one outside the office. The location of the data also matters, particularly if you favor hosting it in Switzerland and controlling its access.
This article presents the factors that influence the budget, the differences between local backup, outsourced copy and replication, as well as the criteria for choosing a model suitable for your SME. You'll also learn how to monitor backups and test restores to support your business continuity.
Key Points
- Define acceptable data loss to set a backup frequency that suits your business.
- Combine tamper-protected copies with separate backups of production systems.
- Combine a local backup with an encrypted offsite copy in Switzerland to increase the resilience of your data.
- Plan the recovery steps and test them: a backup is only useful if your data can be recovered.
- Compare providers based on their approach to security, documentation and service continuity.
Table of contents
- 1. Unalterable copies and protection against attacks
- 2. Managed IT services vs. internal team: what choice for an SME?
- 4. Local backup to Synology NAS and encrypted copy offsite in Switzerland
- 5. Recovery plans and business continuity
- 5. Which providers offer outsourced backup for SMEs in Geneva?
- Flux Group SARL: Flux ICT
1. Unalterable copies and protection against attacks
To protect data against ransomware, combine several measures: encrypt stored and transferred data, limit access rights according to roles and keep an unalterable copy, which cannot be modified during its protection period.
Enable multi-factor authentication for administrative accounts and separate these accounts from those used on a daily basis. So, stealing a password does not automatically give access to backups. Test the restoration of a file, then of an entire system, to verify that the copies remain usable after an attack.
The risk is concrete in Switzerland: the Federal Office for Cybersecurity has identified 79 ransomware attacks in the first half of 2026. A permanently connected backup with the same rights as the production network can be exposed to the same incident. So isolate the copies and regularly check for failure alerts.
In the managed IT services contract, specify the IT scope: servers, workstations, Microsoft 365, applications and data concerned. Also describe the roles of your SME and the service provider, the frequency of backups, their retention period, the storage location and the restoration procedure. For critical data, indicate who authorizes a restore and how the incident is reported.
The SLA, or service level agreement, describes the services, resources and response methods. Distinguish response time from resolution time, then define severity levels and contact channels. Also specify the hours of coverage and the actions planned in the event of a backup failure. Addressing an incident does not mean that systems will be immediately restored.
The minimum size of the company and the duration of the contract depend on the scope, the equipment covered and the desired organization. An SME with a server and a few applications does not have the same needs as a company spread over several sites. The contract must allow services to be adjusted as the IT environment evolves.
Plan for reversibility upon signature: define the data restitution format, access to backups, documentation and transfer arrangements in the event of a change of service provider or re-internalization. Also identify the owner of the data and documentation. These provisions prevent the end of the contract from preventing you from recovering the information necessary for your activity.
2. Managed IT services vs. internal team: what choice for an SME?
The right model depends on available time, internal skills and acceptable level of loss. For an SME with 10 to 50 employees, Managed IT services can provide access to several skills without recruiting each specialist. An internal contact person remains useful: they know the business priorities and coordinate decisions in the event of an incident.
Set the copy frequency based on the volume of work you can recreate. For company work data, the minimum frequency listed is once per day. If losing a day of changes would be too costly, reconcile backups and prioritize data that changes often, like customer records or accounting entries.
An in-house team has direct control of your company's servers, hardware and procedures. However, it must cover backup, monitoring and restoration tasks in addition to its other responsibilities. For companies with 5 to 50 employees, the choice between internal team and managed IT services often arises. Beyond 100 positions, an internal team can become competitive with an outsourced contract.
Managed IT services does not necessarily mean transferring all IT management. You can entrust only backups or systems for which internal resources are lacking, while maintaining daily network management. Compare the services included, coverage times, additional costs and continuity of service: these criteria show what each model involves in practice.
The cloud can host data or applications, but storage is not a substitute for a backup. A synchronized deletion or error can also affect online files. So define the copied data, its retention period and the restoration procedure. For an SME in the canton of Geneva, the storage location and access methods also count in the choice of solution.
Confidentiality requires specific attention when personal data is outsourced. Art. 8 of revised FADP provides for technical and organizational measures adapted to the risk. In practice, identify authorized people, limit their rights and document access to servers and backups. The contract must also specify the responsibilities of each party for data protection.
To compare the two models, list the essential applications, the people who administer them and the data to be restored first. This mapping helps separate tasks that require an in-house presence from those that can be managed remotely. You can then discuss your backup needs based on these priorities.
4. Local backup to Synology NAS and encrypted copy offsite in Switzerland
A Synology NAS can keep a local copy and make it easier to quickly restore a deleted file or damaged folder. But since it is on premises, theft, hardware damage or ransomware can affect both the NAS and the servers. Pair it with an encrypted off-site copy, with access separate from the main network.
The 3-2-1 method recommends three copies of the data, on two different media, including one outside the office. For example, an SME can store production data on its servers, create a copy on its NAS, then transfer another encrypted copy to storage in Switzerland. This hybrid approach combines convenient local recovery and protected remote copying.
What types of outsourced backup are suitable for Geneva SMEs: cloud, hybrid or on-site managed IT services? The cloud allows you to keep a remote copy, while the hybrid model combines local storage and outsourced copy. An on-premises solution can integrate the company's NAS with a remotely managed device, with local interventions if necessary.
To compare backup services in Geneva, look at the scope covered, responsibilities, storage location and restoration steps. The contract or package must specify the protected data, copy monitoring, support arrangements and data restitution. Also request architecture documentation to make it easier to track when your servers, applications or networks evolve.
Geneva SMEs can benefit from local support, service contracts and assistance in French. Support can combine remote assistance and intervention on your premises, depending on the situation. The contract describes the services concerned and the response methods. Also specify the language of communication and the contacts for your SME.
The network also helps protect backups. With Cisco Meraki, an SME can separate production equipment from backup systems. Document authorized access and flows, then verify that a network outage does not block the remote copy. This separation helps clearly define responsibilities related to network administration and data management.
To set a realistic goal, identify servers, priority data, and network dependencies. An SME in Meyrin, for example, can start by protecting its file server and accounting data, then extend the system to other applications. You can study your backup architecture from this inventory.
5. Recovery plans and business continuity
A disaster recovery plan translates business priorities into actionable decisions during an incident. For each application, designate a business manager and a substitute capable of confirming the needs. Specify who can authorize a return to service and who informs employees. This distribution prevents an urgent decision from being blocked by the absence of a key person.
Define two goals for each system. The RPO, or recovery point objective, specifies the acceptable data loss. The RTO (Recovery Time Objective) indicates the maximum acceptable duration of unavailability before the impact on the activity becomes critical. A controls application and an archiving tool may have different purposes. Have these choices validated by the teams who use each system.
Continuity also depends on the links between applications. Billing software may require network access, user accounts and customer data. Document these dependencies and the order of return to service. Article 3 of the OPDo requires in particular that the measures guarantee the availability of data and allow access to be quickly restored after a physical or technical incident. Link this requirement to procedures that your managers can understand.
For each scenario, list the actions in order:
- Identify the services affected and designate the coordination manager.
- Inform the teams concerned with a communication channel planned in advance.
- Confirm technical dependencies before putting an application back into service.
- Have the restored data validated by a business manager.
- Note the decisions made and the tasks remaining to be accomplished.
Plan for a temporary work mode if a critical application remains unavailable. For example, define how to save pending orders, who centralizes this information, and how to re-enter it after recovery. The plan must indicate where to find instructions if the company email is inaccessible. A printed document or kept in a separate space can serve as a reference.
Organize exercises tailored to your team’s roles. A failure simulation makes it possible to verify the decision chain, while a restoration exercise tests the recovery of data and its use by employees. After each exercise, note the blocked steps, missing contacts and gaps between the targeted RTO and the observed progress. Assign each correction to someone responsible.
Revise the plan after any changes to infrastructure, applications or internal responsibilities. Check contact details, emergency access and order of priority with the relevant teams. A dated version makes it possible to distinguish current instructions from old procedures and to keep the system up to date when the organization or tools of your SME evolve.
5. Which providers offer outsourced backup for SMEs in Geneva?
In Geneva, several types of service providers can support the backup of an SME. A managed IT provider can integrate copies with server and network administration. A host or cloud provider may offer remote storage. An integrator can design an architecture that combines local and outsourced resources.
These models meet different needs. A cloud service is suitable for businesses that want to keep a copy offsite without administering the remote infrastructure themselves. An IT provider can coordinate more things, like backup monitoring and recovery assistance. A hybrid solution combines local storage and outsourced copying.
To choose, start from the environment to be protected: servers, workstations, business applications and Microsoft 365 data, for example. Ask for a clear description of the scope, location and responsibilities of each party. In Switzerland, data sovereignty deserves concrete verification: identify the country of storage and the people authorized to access the copies.
A local service provider facilitates exchanges with your teams in Geneva, Meyrin or Vernier. Backups are often monitored remotely, but intervention on your premises can be useful in the event of a hardware failure or complex restoration. The contract must distinguish remote assistance from on-site travel and specify the response methods.
Compare proposals using operational criteria, rather than just storage volume. For each provider, consider the following:
- Data and equipment covered, including servers and business applications.
- The location of storage of copies and the associated access rules.
- Task monitoring, failure alerts and incident tracking.
- The restoration procedure, responsibilities and documentation provided.
- The conditions of exit from the contract and the restitution of data.
An SLA must precisely describe the services included and the contractual response times. Distinguish the handling of an incident from the time required to restore data. Also check the language of assistance, the times covered and the intervention methods. These criteria make it possible to concretely compare the offers intended for Geneva SMEs.
Before choosing a solution, take inventory of critical data and the systems that depend on it. You will thus be able to present your priorities to the service provider and assess the suitability of its system for your organization. An outsourced backup for an SME in Geneva must protect data, but also allow their restitution and the resumption of activity.
Flux Group SARL: Flux ICT
Flux Group SARL supports SMEs with Flux ICT, its IT support service, as well as its cybersecurity services. These skills help integrate data protection into your IT environment and define actions to take after an incident. IT support meets operational needs, while cybersecurity helps protect access and systems.
You can call on Flux ICT if your Geneva SME wishes to better coordinate its IT priorities, security measures and business continuity. Flux Group SARL also offers VoIP phone and business telecommunications services for businesses whose critical infrastructure includes these tools.
To discuss your business needs, contact Flux Group SARL.
Prepare for the next stage of your project
A backup strategy is more effective when it is part of the governance of your SME. Schedule follow-up meetings with the managers concerned to verify that the system still meets the company's priorities. These exchanges allow you to report changes that may modify your needs, before an incident reveals a problem.
To prepare for these discussions, note the decisions to be made, the people to consult and the points that require management approval. You will therefore move forward in stages, with a shared vision between the business and IT teams. The objective: to integrate data protection into the daily management of your activity.
A well-structured project helps you make informed decisions and better control your data over time.
Frequently asked questions about outsourced backup in Geneva
What information should you gather before defining a professional backup?
Start by listing the applications used and their business owners. Add file formats, software dependencies, and peak periods. For example, an accounting close may require different priorities than a typical period. This inventory helps clarify needs, identify forgotten systems and prepare for a productive technical discussion.
How to distribute responsibilities between the internal team and a service provider?
Designate an internal owner for every data or application decision. Then define who can authorize a restore, who notifies business teams, and who maintains documentation. A matrix of responsibilities avoids conflicting demands during an intervention. For an SME, a clearly identified main contact and replacement facilitate coordination in the event of absence or organizational change.
How to prepare for remote assistance in the event of an incident?
Prepare an emergency access procedure that specifies authorized individuals and authentication methods to use. Limit rights to necessary systems and document access granted during the response. Also maintain an inventory of equipment with their names and functions. In Geneva, this information helps the IT team understand precisely the problem, without transmitting passwords by email or messaging.
How to size the device for the volume of data and users?
Evaluate actual active data rather than total disk capacity. Separate daily accessed folders from rarely modified archives, then spot duplicates and temporary files. Also list the shared spaces and user accounts that hold business information. This analysis specifies the perimeter to be protected and facilitates adjustments when your SME adds an application or service.
What elements should be asked to assess the quality of the system?
Request a sample tracking report and verify that it distinguishes between successful tasks, alerts and corrective actions. The documented test procedure must indicate the files or systems restored as well as the checks carried out after recovery. You will thus be able to follow the evolution of the device beyond a simple capacity indicator. Keep these reports with your company's IT documentation.
How to document the journey of data entrusted to a service provider?
Establish a diagram of the exchanges between your applications, the backup environments and the people who administer them. Include copies, technical access as well as restitution or deletion operations at the end of the mandate. This view helps identify indirect transfers and define responsibilities. For a Geneva SME, keep the version up to date with contractual documents and internal procedures.
How to organize liability linked to saved personal data?
Identify the categories of personal data present in backups and the people who determine their use. FADP requires measures adapted to the risks: document decisions, authorized access and instructions applicable to teams. Also integrate incident management into your internal procedure, with a manager responsible for coordinating information and recording actions taken.
How to set recovery frequencies and objectives for each application?
Bring together business managers around concrete scenarios, such as the loss of a day of data entry or the unavailability of production software. For each situation, record the consequences, possible temporary solutions and the order of return to service. A grid per application allows more precise decisions than a uniform rule for the entire company. Revise it when business processes or tools change.
Article by
Delyan TZONEV
Passionate entrepreneur and manager, I am CEO of Flux Group and Hype Swiss. I support companies in their digital transformation thanks to innovative solutions in IT, telecommunications and software development. My goal is to design high-performance technologies that simplify the daily lives of businesses and support their growth.
Disclaimer
The articles published on the Flux Group blog aim to share our expertise, our field experience and best practices in IT, cybersecurity, cloud, telecommunications and digital transformation of SMEs.
We strive to provide reliable, up-to-date and relevant information at the time of publication. However, technologies, regulations and service offerings are evolving rapidly. The published content is therefore provided for informational purposes and does not constitute personalized, legal, tax, financial or technical advice.
Each company has specific needs, we recommend that you seek professional support before making a decision or implementing a solution presented in our articles.
The opinions, recommendations and comparisons published on this blog reflect our analysis and experience. When we talk about partners or publishers such as Microsoft, Swisscom or Infomaniak, our objective is to present the solutions objectively, highlighting their advantages as well as their limitations depending on the different contexts of use.
Flux Group cannot be held responsible for any direct or indirect consequences resulting from the use of the information published on this blog. Links to external sites are provided to complete the information; their content is the responsibility of their respective publishers.
© Flux Group – All rights reserved.
Our services
If you wish to be supported in the choice, deployment or optimization of your IT solutions, the Flux Group experts are at your disposal. We support SMEs in Geneva, Switzerland and Pays de Gex in their Microsoft 365, cybersecurity, cloud, telecommunications, managed IT services and IT infrastructure projects.
Questions fréquentes
What information should you gather before defining a professional backup?
Start by listing the applications used and their business owners. Add file formats, software dependencies, and peak periods. For example, an accounting close may require different priorities than a typical period. This inventory helps clarify needs, identify forgotten systems and prepare for a productive technical discussion.
How to distribute responsibilities between the internal team and a service provider?
Designate an internal owner for every data or application decision. Then define who can authorize a restore, who notifies business teams, and who maintains documentation. A matrix of responsibilities avoids conflicting demands during an intervention. For an SME, a clearly identified main contact and replacement facilitate coordination in the event of absence or organizational change.
How to prepare for remote assistance in the event of an incident?
Prepare an emergency access procedure that specifies authorized individuals and authentication methods to use. Limit rights to necessary systems and document access granted during the response. Also maintain an inventory of equipment with their names and functions. In Geneva, this information helps the IT team understand precisely the problem, without transmitting passwords by email or messaging.
How to size the device for the volume of data and users?
Evaluate actual active data rather than total disk capacity. Separate daily accessed folders from rarely modified archives, then spot duplicates and temporary files. Also list the shared spaces and user accounts that hold business information. This analysis specifies the perimeter to be protected and facilitates adjustments when your SME adds an application or service.
What elements should be asked to assess the quality of the system?
Request a sample tracking report and verify that it distinguishes between successful tasks, alerts and corrective actions. The documented test procedure must indicate the files or systems restored as well as the checks carried out after recovery. You will thus be able to follow the evolution of the device beyond a simple capacity indicator. Keep these reports with your company's IT documentation.
How to document the journey of data entrusted to a service provider?
Establish a diagram of the exchanges between your applications, the backup environments and the people who administer them. Include copies, technical access as well as restitution or deletion operations at the end of the mandate. This view helps identify indirect transfers and define responsibilities. For a Geneva SME, keep the version up to date with contractual documents and internal procedures.
How to organize liability linked to saved personal data?
Identify the categories of personal data present in backups and the people who determine their use. FADP requires measures adapted to the risks: document decisions, authorized access and instructions applicable to teams. Also integrate incident management into your internal procedure, with a manager responsible for coordinating information and recording actions taken.
How to set recovery frequencies and objectives for each application?
Bring together business managers around concrete scenarios, such as the loss of a day of data entry or the unavailability of production software. For each situation, record the consequences, possible temporary solutions and the order of return to service. A grid per application allows more precise decisions than a uniform rule for the entire company. Revise it when business processes or tools change.
Besoin d'un accompagnement IT à Genève ?
Parlons de votre infrastructure, de votre sécurité ou de votre téléphonie. Sans engagement.
Contacter Flux Group