“Don’t worry, we have backups.”
We hear that sentence in almost every first meeting with a new client, and it’s usually said with real confidence. Then we ask a few follow-up questions. What exactly is being backed up? Where do the backups live? How long would it take to restore everything? When did someone last test a restore?
That’s often where the confidence fades. Not because the business did anything wrong, but because having backups and having a recovery plan are two very different things. One is a copy of your data. The other is the ability to keep your business running when something goes wrong.
This post walks through how to close that gap.
Why “we have backups” isn’t enough
Here are some of the most common situations we find when we review a new client’s backups:
- The backup has been failing silently for weeks or months, and nobody was watching the alerts.
- Only some data is protected. The server is backed up, but laptops, cloud apps or a critical line-of-business database are not.
- The backup sits right next to what it’s protecting. An external drive plugged into the server, or a backup stored on the same network, can be destroyed by the same fire, flood or ransomware attack.
- Nobody knows how long a restore would take. Copying terabytes of data back from the cloud over an office internet connection can take days.
- Cloud data is assumed to be safe. Many businesses believe Microsoft 365 or Google Workspace is backing up their email and files. Those services keep your data available, but their built-in retention is limited and isn’t designed to protect you from accidental deletion, a malicious insider or ransomware that syncs encrypted files to the cloud.
Any one of these can turn a bad day into a business-threatening one.
Start with two questions: RTO and RPO
Before choosing backup tools, it helps to answer two questions that IT people describe with a pair of acronyms.
Recovery Time Objective (RTO): How long can you afford to be down? If your main server failed right now, how many hours could your business operate without it? For some businesses the answer is a day. For a medical practice or a busy law firm, it might be an hour or two.
Recovery Point Objective (RPO): How much data can you afford to lose? If you had to restore from your most recent backup, how much work would be lost? A nightly backup means you could lose up to a full day of work. For some systems that’s fine. For others, such as billing, scheduling or accounting, it isn’t.
These answers are business decisions, not technical ones. Once they’re clear, the technology choices become much simpler, and you avoid paying for protection you don’t need or, worse, under-protecting the systems that matter most.
The 3-2-1 rule, updated for ransomware
The classic rule for backups is 3-2-1:
- Keep 3 copies of your data (the original plus two backups).
- Store them on 2 different types of media or systems.
- Keep 1 copy off-site.
That rule still holds, but ransomware has changed the threat. Attackers now look for backups first. So we add two more requirements, sometimes called 3-2-1-1-0:
- 1 copy should be immutable or offline, meaning it can’t be altered or deleted for a set period, even by someone with administrator credentials.
- 0 errors, confirmed by regularly testing that backups can actually be restored.
What a complete disaster recovery plan includes
A real plan covers more than data. It answers the question, “What do we do, step by step, when something goes wrong?” For most small and mid-sized businesses, that means:
1. An inventory of what matters
List your critical systems: servers, line-of-business applications, email, file shares, accounting software, phones and internet connections. Note who depends on each one and the RTO and RPO you decided on.
2. The right backup for each system
Not everything needs the same protection. A file server might need hourly snapshots. Laptops may only need their key folders synced to the cloud. Microsoft 365 needs a dedicated backup. Your accounting database may need something specific to that application.
3. Fast recovery options
For critical servers, modern backup appliances can often run a copy of a failed server directly from the backup within minutes, while the original is repaired. That can turn a multi-day outage into a short interruption.
4. Clear roles and contacts
Who declares a disaster? Who contacts your IT provider, your insurer and your key clients? Who decides whether employees work from home? Write it down, and keep a copy somewhere you can reach it if your network is down.
5. Regular testing
Schedule restore tests at least quarterly for critical systems. Pick a random file, a mailbox or an entire server and actually restore it. Record how long it took. If it didn’t meet your RTO, adjust the plan.
6. Review and update
Businesses change. New applications are added, people come and go, and data grows. Review the plan at least once a year, or any time something significant changes.
Common disasters are rarely dramatic
When people hear “disaster recovery,” they picture tornadoes and floods. Those happen, and North Texas has its share of severe weather. But the events we help clients recover from most often are far more ordinary:
- An employee accidentally deletes a folder, or overwrites an important file.
- A server’s storage fails after years of faithful service.
- A laptop is lost or stolen.
- A ransomware infection encrypts shared files.
- A software update or migration goes wrong.
- A disgruntled employee deletes data on the way out.
The same plan protects you from all of them. The difference is simply how much gets restored and how quickly.
How we approach it for our clients
When we take on a new client, backups are one of the first things we review, because everything else depends on them. Our approach is straightforward, and it is the plan behind our backup and disaster recovery service:
- Assess what you have, what’s actually protected and what isn’t.
- Agree on recovery goals for each critical system, in plain English.
- Implement layered backups, including off-site and immutable copies and Microsoft 365 or Google Workspace backup.
- Monitor every backup job daily, so failures get fixed the same day instead of being discovered during an emergency.
- Test restores on a schedule and report the results to you.
- Document a recovery plan your team can actually follow.
Microsoft 365 backup is included in our Business and Premium plans, and our Premium plan includes annual business continuity planning. You can see what’s included in each plan on our pricing page.
Five questions to ask about your backups today
Before you close this page, it’s worth asking your IT person or provider:
- What systems and data are not currently backed up?
- Where are the backups stored, and is at least one copy off-site and immutable?
- When was the last successful test restore, and what was restored?
- If our main server failed right now, how long until we’re working again?
- Is our Microsoft 365 or Google Workspace data backed up by a separate service?
If any of those answers are unclear, that’s a good reason to take a closer look now, while it’s a planning exercise instead of an emergency.
Not sure your backups would work when you need them? We’ll review your backup setup in a free assessment and quote a restore test if you want one.
