By Akash Sengar · · 7 min read
Why backup and recovery need a plan
Hardware fails, people delete things, and ransomware encrypts whatever it can reach. A disaster recovery plan for a small business answers three questions in advance: what must be recovered, how quickly, and from where. Without those answers, backups are often found to be incomplete or untested at the worst moment.
RPO vs RTO
- Recovery Point Objective (RPO): how much data you can afford to lose, measured in time. An RPO of 24 hours means a daily backup is enough; an RPO of 15 minutes needs something more frequent.
- Recovery Time Objective (RTO): how long a system can be down before the business is seriously hurt.
Set them per system, not for the whole business. Accounting may tolerate a day; your online shop or production line may not. Agree them with the business owners, then design backups to meet them. Shorter targets cost more, so set them honestly.
The 3-2-1 backup rule, and immutable copies
The 3-2-1 rule is a widely used baseline: keep three copies of your data, on two different types of storage, with one copy off-site. Today, add one more requirement: at least one copy should be immutable or offline, meaning it cannot be changed or deleted for a set period, even by an administrator. Attackers often target backups first; an immutable copy is what saves you then.
Also protect backup systems themselves: separate admin accounts with MFA, no domain-joined backup servers where avoidable, and alerts on backup failures and deletions.
Does Microsoft 365 need backup?
Microsoft runs a resilient service, but resilience and backup are not the same. Microsoft's own FAQ for Microsoft 365 Backup explains that disaster recovery copies keep the current state of content, not historical versions, and that its stance on shared responsibility for data protection has not changed (Microsoft Learn). In practice, protecting against deletion, malicious changes or ransomware in your tenant is your responsibility.
Built-in features help: deleted items retention, version history in OneDrive and SharePoint, and retention policies. But they are designed for user recovery and compliance, not mass restore. Microsoft notes that versions can be exhausted and do not scale to large ransomware recovery, and that legal holds are optimised for export rather than restore (Microsoft Learn). Microsoft now offers Microsoft 365 Backup as a paid add-on for Exchange Online, OneDrive and SharePoint, and third-party backup products cover similar ground. Teams chats, Planner and other workloads may need separate consideration.
Does Google Workspace need backup?
Google describes Google Vault as an information governance and eDiscovery tool: it retains, holds, searches and exports data. It is not a restore tool. Importantly, if you delete a user, all their data is removed and Vault can no longer search or export it; Google allows restoring a deleted user only for a limited period (Google Vault FAQ). For leavers, Google recommends an Archived User licence instead of deletion. If you need point-in-time restore of Gmail and Drive, use a dedicated backup product.
Servers, NAS and cloud VMs
- Back up the whole server or VM image as well as key data, so you can rebuild quickly.
- For cloud VMs on AWS or Azure, use snapshots plus backups stored in a separate account or vault with deletion protection.
- A NAS on the same network is not an off-site copy; ransomware can reach it.
- Back up configuration too: firewall, switches, DNS records and your Microsoft 365 or Google Workspace settings.
Ransomware and backups
When ransomware hits, restore only after the attacker's access is removed and you know when the compromise started. Restoring a backup taken after the attacker got in brings the problem back. Keep enough history, often several weeks, to reach a clean point. Our incident response plan guide covers the steps around a restore.
Other SaaS data
Beyond email and files, small businesses keep critical data in CRM, accounting, HR and helpdesk tools. Check each vendor's documentation for what it backs up, how long deleted data is kept and how you can export your data. Where the vendor offers no point-in-time restore, schedule regular exports to storage you control, and include them in your restore tests.
Also keep an offline record of how to rebuild access: registrar and DNS logins, licence details, admin recovery codes and vendor support contacts. After a ransomware attack, these are often harder to recover than the data itself.
Backup checklist
- Every critical system listed with an owner, RPO and RTO.
- Microsoft 365 or Google Workspace covered by a backup product, not only retention or Vault.
- Servers and VMs backed up as full images plus data.
- At least one immutable or offline copy, stored separately.
- Backup admin accounts separate from everyday accounts, with MFA.
- Alerts for failed jobs, and someone who reads them.
- Monthly small restores and twice-yearly full restores, recorded.
- Retention long enough to reach a clean point after a slow-moving attack.
Restore testing
A backup is only proven by a restore. Test regularly:
- Restore a single file and a single mailbox every month.
- Restore a full server or VM to an isolated network at least twice a year, and time it against your RTO.
- Record date, what was restored, how long it took and any problems.
- Fix what the test reveals, then test again.
Restore tests often reveal problems nobody expected: a missing encryption key, a backup job that silently skipped a folder, a licence needed to restore, or a restore that takes far longer than the RTO. Each one found in a test is one that will not surprise you during a real incident.
What drives backup cost
We do not quote prices here. The main cost drivers are the amount of data protected, how far back you keep it, how often you back up, the type of storage used for immutable or off-site copies, and the time your team or provider spends checking jobs and running restore tests. Shorter RPO and RTO targets usually mean more frequent backups, faster storage or standby systems, and therefore higher cost. Agree targets first, then compare options against them.
Writing the disaster recovery plan
- A list of systems with owner, RPO, RTO and where the backups are.
- Step-by-step restore instructions anyone competent can follow, stored outside the systems they protect.
- Contacts: IT provider, cloud and backup vendors, insurer.
- Decision points: who declares a disaster and who approves restoring to a new site.
For organisations that want a formal framework, ISO 22301 sets requirements for business continuity management, of which disaster recovery is one part; see our ISO 22301 page. Our cloud infrastructure service designs backup and DR, and runs restore tests with written records.
