Mittelstand backup is usually the responsibility of one or two administrators who also run the network, the ERP system, the phones and whatever broke that morning. The German Mittelstand is made up of small and medium-sized companies, defined by the IfM Bonn research institute as those with fewer than 500 employees and annual turnover of up to 50 million euros. Many are manufacturers with a production line that cannot stop, an IT team that fits in one office and no dedicated backup specialist. Their backup has to be reliable without daily attention, and it increasingly has to stand up to outside scrutiny.
This post looks at what has changed for these companies, where small teams lose time and how to arrange backup so that two people can run it properly.
Three pressures arrive at once. The first is regulatory. Germany's law implementing the European NIS2 directive entered into force on 6 December 2025 and brings more than 30,000 companies into scope. In the listed sectors it reaches companies from 50 employees or more than 10 million euros in turnover, which describes a large part of the Mittelstand, and backup management is among the measures it expects. The second is tax law: the GoBD principles require electronic accounting records to be kept unaltered and machine-readable for the whole retention period, and a backup alone does not meet that. The third is commercial. Larger customers and cyber insurers send questionnaires that ask how backups are protected and when a restore was last tested.
None of these require a large team. They require that a few things are true and can be shown.
Backup consumes time in predictable places. Knowing which of them can be designed out is the fastest way to make the workload fit.
| Task | Why it costs time | How to reduce it |
|---|---|---|
| Checking job results | Daily reports are read by hand, or not at all | Alert only on failures and on jobs that did not run |
| Fixing failed jobs | The same few causes recur | Track causes for a month and remove the top two |
| Capacity firefighting | The repository fills without warning | Alert on days of headroom, not percent used |
| Patching | Backup server, repository and firmware each have a cycle | One monthly window covering all three |
| Restore requests | Every file restore interrupts other work | Documented steps a colleague can follow |
| Audit questions | Evidence is assembled from scratch each time | Scheduled exports and a restore log kept as tests happen |
The arithmetic of this workload is worked through in counting backup administration costs for small IT teams, and recurring backup job failures covers how to find the causes worth removing.
The defining risk in a two-person team is that knowledge lives in one head. A backup design for the Mittelstand should assume that the person who built it is unavailable on the day it is needed. That has practical consequences. The restore procedure for the most important systems is written down and has been followed at least once by someone other than its author. Credentials for the backup server and the repository are stored where a second authorized person can reach them, not in a personal password manager. And the configuration is simple enough to explain in an hour: fewer job types, one retention scheme, one repository design.
Handing over backup storage lists what a successor or a stand-in needs to find.
Large organizations defend backups with monitoring teams. A small company cannot, so the protection has to be structural. Three properties do most of the work. Backup copies are immutable for a set period, enforced by the storage and not by a setting an administrator account can switch off. The repository has its own accounts, outside the Windows domain, so that a compromised domain administrator does not automatically control the backups. And administrative logins to the backup server and the repository require a second factor.
These measures are set once and then hold without daily effort, which is exactly what a small team needs. Backup security reviews for a small IT team gives a short list of checks that two people can run in an afternoon to confirm each one.
Restore testing is the task most often postponed, because nothing visibly breaks when it is skipped. A workable rhythm for a small team is one test a month, rotating through the systems that matter: a file server one month, the ERP database the next, a domain controller after that. Each test is recorded in a single line with the date, the system, the restore point, the duration and the result. After a year that log is the evidence an auditor or insurer asks for.
Many Mittelstand companies work with a systems house. A sensible division leaves installation, upgrades and second-level support with the partner, and keeps three things inside the company: ownership of the credentials, the ability to perform a restore without waiting for the partner, and the decision on retention. A backup that only an external party can restore from is a dependency that shows up at the worst moment.
ARTESCA is object storage software used as a backup target, deployed on the customer's own servers as a software appliance on industry-standard x86 hardware or delivered as a pre-configured hardware appliance. Immutability is provided by S3 Object Lock on each object, and in compliance mode no account, including ARTESCA administrators, can remove a lock before it expires. That gives a small team protection that does not rely on someone watching.
The repository has its own administrative accounts, separate from the backup server and the production directory. ARTESCA grows within the same deployment from roughly 50 TB to 8.5 PB, so a company does not have to redesign its backup target as data grows, and it is used with Veeam and other backup software.
For a team of two, the best starting point is not a project. It is an hour spent answering three questions in writing: could a colleague restore the ERP system from the documentation alone, could a compromised domain administrator delete the backups, and when was the last restore test. Each answer that is not a clear yes or a recent date points to the next piece of work.