Backup and Disaster Recovery for Small Businesses: What You Need

A small business needs automated backups of everything important (servers, Microsoft 365 and laptops), kept under the 3-2-1 rule with at least one copy ransomware can’t reach, plus written recovery steps and regular test restores. Having backups isn’t the goal. Proving you can recover, and knowing how fast, is.

“We have backups” is not a disaster recovery plan.

Almost every business backs up something. But when disaster hits (ransomware encrypts your files, a server dies, a fire or burst pipe takes out the office), the question isn’t whether you have backups. It’s whether you can actually recover, and how fast.

Most businesses that think they’re covered find the gaps when it’s too late. Backups nobody has tested. Recovery steps that only exist in one person’s head. Recovery times measured in days when the business needs hours.

Here’s what a small or midsize business actually needs for backup and disaster recovery, and how to tell if what you have is enough.

Why Do Small Businesses Need Better Backups?

Your business runs on its data: customer records, job files, accounting, drawings, contracts, email. Lose it, or lose access to it for a week, and you may not recover. Ransomware crews target small and midsize businesses because they often have weaker defenses and can’t afford long downtime.

Operations Depend on Access

When your data is unavailable:

• Staff can’t look up customers, orders or jobs
• Quotes, invoices and payroll stall
• Project files and drawings are out of reach
• Decisions get made on guesswork

That’s not an inconvenience. It’s the business stopped.

Legal and Contractual Obligations

Depending on what you do, you may be required to keep records and protect them:

• Tax and financial records have retention requirements
• Customer contracts may require data protection and continuity
• Insurance agencies, financial firms and others have industry data security rules
• If you handle health data, HIPAA requires a backup plan, a disaster recovery plan and an emergency operations plan

Your cyber insurance carrier may also ask about your backups before they’ll write or renew a policy.

Financial Survival

Extended downtime threatens the business:

• Lost revenue during recovery
• Emergency IT costs
• Overtime to catch up
• Customers who leave
• Reputation damage

Ransomware Reality

Attackers know:

• Smaller businesses often have weaker security
• Business data is valuable to its owner
• Owners are desperate to get back up and running
• Many will pay

Good backups are your ransomware insurance. Without them, you’re either paying criminals or starting over.

Learn more about cybersecurity

What Should a Backup Plan Include?

A solid plan covers four things: reliable copies of all your important data, written steps to restore it, a way to keep working during an outage, and regular testing to prove it all works.

Data Backup

Regular, automated copies of everything that matters.

What this means:

• Servers, shared drives and line-of-business databases
• Microsoft 365 or Google Workspace data (email, OneDrive, SharePoint, Teams)
• Anything people store on their own laptops
• Backups that are complete and restorable

Disaster Recovery Procedures

Written steps for getting systems back.

What this means:

• Documented recovery procedures
• Named people with assigned roles
• A defined order of what comes back first

Keeping the Business Running

A plan for operating while systems are down.

What this means:

• How you’ll take orders, answer phones and serve customers
• Alternative ways to reach critical data
• Who decides when to switch to backup procedures

Testing and Updates

Proof that the plan works, and that it stays current.

What this means:

• Regular test restores
• Plan updates when systems change
• Records of each test

Knowing What’s Critical

Rank your systems and data by how much the business depends on them.

What this means:

• Know which systems you can’t run without
• Recover in that order
• Spend money where it matters most

What Is the 3-2-1 Backup Rule?

Keep three copies of your data, on two different types of storage, with one copy off-site. Because ransomware goes after backups, add at least one copy that’s immutable or disconnected so attackers can’t reach it from your network.

3 Copies of Data

• The original production data
• A first backup copy
• A second backup copy

One copy isn’t a backup. It’s a single point of failure. Two copies can fail at the same time. Three gives you real protection.

2 Different Storage Types

Don’t keep every backup the same way:

• Local storage (NAS, backup appliance, server)
• Cloud storage
• Tape (less common now, still used)

Different media protects against failures specific to one type.

1 Copy Off-Site

At least one backup has to live somewhere else:

• Cloud backup in a remote data center
• Replication to another location

That protects you from fire, flood, theft or a break-in at the office.

For Ransomware: Make One Copy Untouchable

Modern ransomware hunts for backups. CISA’s #StopRansomware Guide tells organizations to keep offline, encrypted backups of critical data and to regularly test that they can be restored. Protect at least one copy:

• Immutable backups that can’t be changed or deleted
• Cloud backups with versioning and retention locks
• A copy that’s disconnected from your network

If attackers can reach your backups from your network, they can encrypt those too.

RTO and RPO: How Fast Do You Need to Recover?

RTO is how long a system can be down before it hurts the business. RPO is how much recent work you can afford to lose. Set both for each important system, then build backups that meet them.

Two numbers define what your backup system has to do.

Recovery Time Objective (RTO)

How long can you be down?

RTO is the longest acceptable time from disaster to back in business.

Example RTOs for a small business:

System	Typical RTO
Core business software (ERP, CRM, job management)	4-8 hours
Email	4-8 hours
Accounting	8-24 hours
Phone system	2-4 hours
Website	24 hours
Archive data	48-72 hours

These are starting points. Yours depend on how your business runs.

Consider:

• How long can you operate without this system?
• What does an hour of downtime cost?
• What happens to customers in the meantime?

Recovery Point Objective (RPO)

How much data can you afford to lose?

RPO is the maximum acceptable data loss, measured in time.

Example:

• RPO of 1 hour means you can lose up to an hour of work
• So backups have to run at least hourly

Example RPOs:

Data Type	Typical RPO
Orders, transactions, job records	15-60 minutes
Financial and billing	1-4 hours
Email	4-24 hours
Documents	24 hours

Consider:

• How much work would have to be redone?
• Is there a paper trail for recent entries?
• What does it cost to recreate lost data?

The Trade-Off

Shorter RTO and RPO cost more:

• Faster recovery needs better infrastructure
• More frequent backups need more storage and bandwidth
• Instant failover needs redundant systems

Find the balance between protection and cost.

Is Cloud Backup Right for a Small Business?

For most small businesses, yes. Cloud backup puts a copy off-site automatically and needs no extra hardware, and pairing it with a local backup gives you fast restores and disaster protection at the same time.

Cloud backup is now the standard for most small businesses.

Advantages of Cloud Backup

Off-site by default: Data is stored somewhere else automatically Scalable: Storage grows with you Automated: Runs on its own (but still test it) Accessible: Restore from anywhere with internet Less hardware: Nothing extra to maintain in your closet

Types of Cloud Backup

File-level backup:

• Backs up individual files and folders
• Simple and straightforward
• Good for documents
• Slower to rebuild a whole system

Image-based backup:

• Captures the entire system
• Faster full recovery
• Needs more storage
• Can restore entire servers

Application-specific backup:

• Built for databases and specific software
• Keeps application data consistent
• Sometimes provided by the software vendor

Don’t Forget Microsoft 365 and Google Workspace

A common blind spot: Microsoft and Google keep their services running, but they’re not a full backup of your data. Microsoft’s own shared responsibility model lists your data and accounts as your responsibility, even in Microsoft 365. Deleted items and retention windows have limits, and a compromised account or a bad sync can wipe out files. If your business, or a fully remote team, lives in Microsoft 365, back it up separately.

What to Check in a Backup Provider

Common business backup platforms include:

• Datto (popular with managed IT providers)
• Veeam
• Carbonite
• Acronis
• Druva

Verify before signing up:

• Encryption in transit and at rest
• Data center security certifications
• Retention options and immutability
• How fast a full restore actually takes
• If you handle health data, whether they’ll sign a HIPAA Business Associate Agreement

Learn more about cloud solutions

How Often Should You Test Your Backups?

Check that backup jobs finish every day, do spot restores monthly, run a full system restore quarterly, and walk through a full disaster recovery drill once a year. Most businesses never test, and find out their backups don’t work in the middle of an emergency.

Here’s the uncomfortable truth: most businesses don’t test their backups. And plenty find out during a real emergency that the backups don’t work.

Why Backups Fail

Silent failures:

• Jobs error out without anyone getting notified
• Storage fills up and backups stop
• Credentials expire and jobs fail

Configuration drift:

• New folders or shares never get added
• System changes don’t make it into the backup
• New software gets installed without backup coverage

Corruption:

• Backups finish but the data is corrupted
• Ransomware encrypts files before the backup runs
• Media degrades over time

Incomplete scope:

• Critical data left out
• Application databases missed
• Files on individual laptops overlooked

Testing Approaches

Verification reports (daily minimum):

• Confirm backup jobs finished
• Check logs for errors
• Verify expected data volume
• Alerts on failures

Spot restore tests (monthly):

• Restore random files or folders
• Check the data is intact
• Note how long it takes
• Write down the results

Full system restore tests (quarterly):

• Restore complete systems to a test environment
• Confirm applications actually run
• Check data consistency
• Measure real recovery time

Disaster recovery drill (annually):

• Walk through a realistic disaster scenario
• Run the full recovery procedures
• Involve the people who’d actually be involved
• Find the gaps and update the plan

What to Document

For each test:

• Date and type of test
• What was tested
• Result
• Actual recovery time
• Problems found
• What you changed

This record helps with insurance questionnaires, audits and getting better over time.

What Goes in a Disaster Recovery Plan?

A disaster recovery plan covers what could go wrong, which systems come back first, step-by-step restore instructions with named owners, how you’ll communicate with staff and customers, and how you’ll keep working until systems are back.

Backups are only half of it. You also need a plan to recover.

Key Plan Components

1. Risk Assessment

• What could actually happen? (ransomware, hardware failure, fire, flood, a key person leaving)
• How likely is each?
• What would each one cost you?

2. Recovery Priorities

• Which systems matter most?
• What order do they come back in?
• What can wait?

3. Recovery Procedures

• Step-by-step restore instructions
• Who does what
• Contact info for key people
• Vendor contact info

4. Communication Plan

• How to reach staff
• How to update customers
• Who talks to the outside world
• How status updates go out

5. Working Without Systems

• How to operate during recovery
• Paper or manual procedures
• An alternate location if needed
• Remote work as a fallback

Sample Priority Order

A typical recovery order for a small business:

1. Network and internet (everything else depends on it)
2. Phones (customers need to reach you)
3. Core business software (the system that runs operations)
4. Accounting and billing
5. Email and communication
6. Workstations (shared or spare machines can fill in at first)
7. Everything else

Plan Maintenance

Plans go stale fast:

• Review after any major system change
• Keep contact info current
• Test procedures after updating them
• Do a full review every year

How Do You Build a Backup and Recovery Strategy?

List what needs protecting, set recovery targets for each system, design backups to meet them, document the restore steps, and test on a schedule. The steps below take most small businesses from “we think we’re covered” to a plan they’ve proven.

Step 1: Inventory Critical Systems

List everything that needs protection:

• Servers and what they do
• Applications and databases
• Where staff save files
• Cloud services, including Microsoft 365
• Configuration files

Step 2: Set RTO and RPO

For each system, decide:

• How long it can be down
• How much data you can lose
• What each scenario costs the business

Step 3: Design the Backup Setup

Based on those numbers:

• Local backup for fast recovery
• Cloud backup for off-site protection
• Backup frequency that meets your RPO
• Retention that meets your legal and contract requirements

Step 4: Implement and Configure

• Deploy the backup tools
• Cover every data source
• Set up monitoring and alerts
• Test the first backups

Step 5: Document Procedures

• Recovery steps for each system
• Roles and responsibilities
• Contact info
• How to keep working during an outage

Step 6: Test and Maintain

• Regular test restores
• Annual disaster recovery drill
• Updates when systems change
• Ongoing monitoring

What Are the Most Common Backup Mistakes?

The most common mistakes are never checking that backups run, leaving out cloud data and application databases, keeping no off-site copy, never testing a restore, having no written procedures, and keeping too little history to get past a ransomware infection.

”Set It and Forget It”

Backups need watching. Jobs fail. Storage fills up. Settings drift. Without regular attention, you find the problem when you need to recover. Automated monitoring helps here. We explain how in 24/7 IT monitoring vs. 24/7 support.

Backing Up the Wrong Things

Common misses:

• Application databases (copying the files isn’t enough)
• Cloud data (assuming Microsoft or Google has it covered)
• Laptops (when people save locally)
• Configuration files (system settings, not just data)

No Off-Site Copy

Local backups protect you from hardware failure. They don’t protect you from fire, flood, theft, or ransomware that reaches the backup server.

Untested Backups

A backup that’s never been tested is a hope, not a plan.

No Written Procedures

During a disaster, stress is high and nobody thinks clearly. Written, practiced procedures make the difference.

Short Retention

Ransomware can sit quietly for weeks before it goes off. If your backups only go back 7 days, you may not have a clean copy to restore.

---

Is Your Backup Plan Ready for a Bad Day?

At MedTech Consulting, we set up and monitor backup and disaster recovery for businesses across Gwinnett, Barrow and Walton counties, including Microsoft 365 backup for remote teams. We set recovery targets that fit your business and test that restores actually work.

Contact us or email help@medtechconsulting.net for a backup and recovery review.

---

Related reading: Cloud Solutions | Cybersecurity | Managed IT Support

Frequently Asked Questions

How often should a small business test its backups?

Check that backup jobs complete every day, restore a few random files every month, restore a full system to a test environment every quarter, and run a full disaster recovery drill once a year. Write down the results of each test, including how long the restore actually took. Untested backups often fail silently, and most businesses only discover that during a real emergency.

What is the 3-2-1 backup rule?

Keep three copies of your data, on two different types of storage, with one copy off-site. Because ransomware actively looks for backups to encrypt, make at least one copy immutable or disconnected from your network so an attacker who gets into your systems can't reach it.

Does Microsoft 365 back up my business data?

Not fully. Microsoft keeps the service running, but under its shared responsibility model your data and user accounts remain your responsibility. Deleted items and retention windows have limits, and a compromised account or bad sync can wipe out files. Businesses that rely on Microsoft 365 should back up email, OneDrive, SharePoint and Teams separately.

What's the difference between backup and disaster recovery?

A backup is a copy of your data. Disaster recovery is the plan for getting the business running again: which systems come back first, who does what, how long each restore takes, and how you keep serving customers in the meantime. You need both. Backups without a recovery plan still leave you guessing during an outage.

How long should a small business keep backups?

Long enough to reach a clean copy. Ransomware can sit unnoticed for weeks before it encrypts anything, so a backup set that only goes back seven days may contain nothing but infected files. Keep daily versions for several weeks plus older monthly copies, and check any legal or contract record-retention requirements for your industry.