Managed IT

How long could your business survive an IT outage? Backup and disaster recovery, explained

Most businesses can’t answer the question in the title, and the honest answer is usually “less time than we’d like to admit”. Backup is the copy of your data; disaster recovery is the tested plan for getting the business running again. Having the first without the second is the most common resilience gap we see, and it only reveals itself on the worst possible day. Here’s how to think about both, without the jargon.

Two numbers define your plan

Every disaster recovery conversation comes down to two questions:

  • How quickly do systems need to be back? This is your recovery time objective (RTO). An hour? A day? A week?
  • How much recent work can you afford to lose? This is your recovery point objective (RPO). If you restore last night’s backup, is losing today’s work acceptable?

There are no universally right answers, only honest ones. A firm billing by the hour bleeds money every hour it’s down. The point is that these are business decisions, not technical ones, and everything else (what you back up, how often, to where) follows from them. If nobody in your business has ever set these numbers, your current setup reflects an accident, not a decision.

The 3-2-1 rule still works

The classic test of a backup setup: three copies of your data, on two different types of storage, one of them off-site. It survives because it catches the failure everyone forgets: the single event that takes out everything at once. A backup drive sitting next to the server it protects doesn’t survive the fire, the flood or the burglary. A backup that’s permanently connected to the network doesn’t survive ransomware, because modern ransomware looks for backups first and encrypts or deletes them before touching anything else.

That last point has upgraded the rule in practice: at least one copy should be immutable or offline, meaning it cannot be altered or deleted even by an administrator account, because attackers who get in usually get admin.

”It’s in the cloud” is not a backup plan

The most dangerous sentence in SME resilience. Two clarifications:

Microsoft 365 does not back up your data in the way you think. Microsoft’s shared responsibility model is explicit: they keep the service available, you protect the data. Retention windows for deleted items are limited, and anything a user or attacker deletes or encrypts syncs everywhere quickly. A third-party Microsoft 365 backup, covering mail, OneDrive, SharePoint and Teams, is a small monthly cost that closes the gap. We include this in most cloud and Microsoft 365 engagements as a matter of course.

Sync is not backup. OneDrive and Dropbox replicate your files, including the encrypted ones, everywhere, faithfully and fast. That’s the opposite of protection.

The test that matters: restoring

Backups fail silently. Jobs error out for weeks unnoticed, backup drives fill up, and the folder everyone assumed was covered turns out not to be. The only way to know your plan works is to test restores on a schedule: pick a file, a mailbox, a whole server, and actually bring it back, timing how long it takes against your RTO.

This is where a managed service earns its keep. Within our managed IT support, backups are monitored daily, failures are investigated the day they happen rather than the day you need the data, and restores are tested regularly so the recovery time is a measured fact, not a hope.

A five-point self-assessment

  1. Do you know your RTO and RPO, as decisions rather than guesses?
  2. Does at least one backup copy live off-site, immutable or offline?
  3. Is Microsoft 365 backed up separately from Microsoft itself?
  4. When did someone last test a restore, and time it?
  5. If your office were inaccessible tomorrow, is there a written plan for who does what?

Score below five and you’re in the majority, but “the majority” is exactly who ransomware works on. The gap between where you are and a genuinely resilient setup is usually smaller and cheaper than expected: most of it is configuration and discipline, not new kit.

Book a consultation and we’ll review your current backup and recovery position honestly, including the parts that are already fine.

FAQs

Frequently asked questions

What is the 3-2-1 backup rule?

Keep three copies of your data, on two different types of storage, with one copy held off-site. It's the simplest test of whether a backup setup is resilient: if a single event (a ransomware attack, a fire, a stolen server) can destroy every copy at once, you don't really have a backup, you have a delay.

Does Microsoft 365 back up my data?

Not in the way most people assume. Microsoft keeps the service running and replicates your data for availability, but under its shared responsibility model, protecting the data itself is your job. Deleted files and mailboxes are only recoverable within limited retention windows, and a ransomware attack or malicious deletion can sync everywhere before anyone notices. A separate Microsoft 365 backup closes that gap.

What is the difference between backup and disaster recovery?

Backup is the copy of your data. Disaster recovery is the plan for getting the business running again: how quickly systems come back (your recovery time objective) and how much recent work you can afford to lose (your recovery point objective). Plenty of businesses have backups but no tested way to restore quickly, which they only discover mid-crisis.

Ready to work smarter, act faster?

Book a free, no-obligation consultation. We’ll review your IT, security and print, and show you exactly where we can help.