“How do you keep our data safe?” Your backup routine

Every organisation here has lost data at least once: a laptop stolen from a car in Mogadishu, a server killed by a power surge in Hargeisa, a finance officer who deleted a folder by mistake, ransomware from a fake email. So the panel asks: how would you keep our data safe? They score habits and routine, not products. “We have antivirus” is the weakest answer you can give.

• Backups with a rule: 3-2-1 is easy to remember and easy to say: three copies, on two different kinds of storage, one kept off site or in the cloud. Say how often (nightly for finance and HR data, weekly for the rest).
• Test the restore: a backup nobody has restored is a hope, not a backup. Say you restore one folder every month and write the date in a log.
• Access by role: each person gets only what the job needs. Admin rights only for IT, a folder per department on the shared drive, and accounts closed the day someone leaves.
• Accounts: strong unique passwords, two-step login on email, finance systems and the Facebook page, and a password manager or a locked sheet instead of a WhatsApp message.
• Updates and antivirus: Windows and browsers updated, antivirus on, USB sticks scanned. This is the floor, not the ceiling.
• People: a 20-minute session for staff on fake emails and calls, because most attacks start with someone clicking.

Local details make the answer real: power cuts and surges, so a UPS and a surge protector on the server; laptops that travel to the field, so full-disk encryption (BitLocker) and a screen lock; internet that drops, so backups that resume on their own, and a second copy on an external disk kept in the safe, not on the shelf next to the server.