How long could your business survive an IT outage? Backup and disaster recovery, explained
Most businesses can’t answer the question in the title, and the honest answer is usually “less time than we’d like to admit”. Backup is the copy of your data; disaster recovery is the tested plan for getting the business running again. Having the first without the second is the most common resilience gap we see, and it only reveals itself on the worst possible day. Here’s how to think about both, without the jargon.
Two numbers define your plan
Every disaster recovery conversation comes down to two questions:
- How quickly do systems need to be back? This is your recovery time objective (RTO). An hour? A day? A week?
- How much recent work can you afford to lose? This is your recovery point objective (RPO). If you restore last night’s backup, is losing today’s work acceptable?
There are no universally right answers, only honest ones. A firm billing by the hour bleeds money every hour it’s down. The point is that these are business decisions, not technical ones, and everything else (what you back up, how often, to where) follows from them. If nobody in your business has ever set these numbers, your current setup reflects an accident, not a decision.
The 3-2-1 rule still works
The classic test of a backup setup: three copies of your data, on two different types of storage, one of them off-site. It survives because it catches the failure everyone forgets: the single event that takes out everything at once. A backup drive sitting next to the server it protects doesn’t survive the fire, the flood or the burglary. A backup that’s permanently connected to the network doesn’t survive ransomware, because modern ransomware looks for backups first and encrypts or deletes them before touching anything else.
That last point has upgraded the rule in practice: at least one copy should be immutable or offline, meaning it cannot be altered or deleted even by an administrator account, because attackers who get in usually get admin.
”It’s in the cloud” is not a backup plan
The most dangerous sentence in SME resilience. Two clarifications:
Microsoft 365 does not back up your data in the way you think. Microsoft’s shared responsibility model is explicit: they keep the service available, you protect the data. Retention windows for deleted items are limited, and anything a user or attacker deletes or encrypts syncs everywhere quickly. A third-party Microsoft 365 backup, covering mail, OneDrive, SharePoint and Teams, is a small monthly cost that closes the gap. We include this in most cloud and Microsoft 365 engagements as a matter of course.
Sync is not backup. OneDrive and Dropbox replicate your files, including the encrypted ones, everywhere, faithfully and fast. That’s the opposite of protection.
The test that matters: restoring
Backups fail silently. Jobs error out for weeks unnoticed, backup drives fill up, and the folder everyone assumed was covered turns out not to be. The only way to know your plan works is to test restores on a schedule: pick a file, a mailbox, a whole server, and actually bring it back, timing how long it takes against your RTO.
This is where a managed service earns its keep. Within our managed IT support, backups are monitored daily, failures are investigated the day they happen rather than the day you need the data, and restores are tested regularly so the recovery time is a measured fact, not a hope.
A five-point self-assessment
- Do you know your RTO and RPO, as decisions rather than guesses?
- Does at least one backup copy live off-site, immutable or offline?
- Is Microsoft 365 backed up separately from Microsoft itself?
- When did someone last test a restore, and time it?
- If your office were inaccessible tomorrow, is there a written plan for who does what?
Score below five and you’re in the majority, but “the majority” is exactly who ransomware works on. The gap between where you are and a genuinely resilient setup is usually smaller and cheaper than expected: most of it is configuration and discipline, not new kit.
Book a consultation and we’ll review your current backup and recovery position honestly, including the parts that are already fine.