Most business owners can answer “do we have backups?” with a confident yes. Far fewer can answer the question that actually matters after a ransomware attack, a failed server, or a flooded office: how long until we’re working again, and how much do we lose along the way? That’s the gap between a backup and business backup and disaster recovery — a backup is a copy of your data; disaster recovery is the plan and tooling that get your people back to work. Each type of event tests something different, and a business that’s only ever tested the first one is often surprised by the second.
Two numbers that matter more than “we have backups”
Two measurements decide whether a recovery plan actually fits your business. RTO (Recovery Time Objective) is how long you can tolerate being down — minutes, hours, or days — before it seriously hurts the business. RPO (Recovery Point Objective) is how much data you can afford to lose, measured in time. If your backup runs once overnight, your RPO is effectively a full day: anything created or changed since last night’s backup is gone if something happens at 3pm. Most small businesses have never written either number down, which makes it hard to know whether their current backup and disaster recovery setup is actually enough — or wildly inadequate for how the business runs today.
The 3-2-1 rule, plus the piece ransomware exploits
The standard backup guideline is 3-2-1: three copies of your data, on two different types of media, with one copy off-site. It’s a good baseline, but it predates modern ransomware, which actively hunts for backups and encrypts or deletes them along with everything else. That’s why a current plan also needs an immutable or air-gapped copy — a backup that ransomware on your network literally cannot reach or alter, because it’s offline, isolated, or write-protected for a set retention period. Without that piece, attackers who get into your network can wipe out your “safety net” in the same incident that locked up your live data.
Microsoft 365 isn’t automatically backed up
This is the most common gap we see. Microsoft is responsible for keeping its cloud infrastructure running — it is not responsible for recovering a file your team permanently deleted, a mailbox wiped by a compromised account, or a SharePoint library overwritten by a bad sync. The Recycle Bin and version history built into Microsoft 365 are retention features with time limits, not a backup. A third-party backup for Microsoft 365 captures mailboxes, OneDrive, SharePoint, and Teams data on its own schedule, with its own retention, so “it’s in the cloud” stops being a guess and starts being an actual recovery point.
What disaster recovery adds on top of backups
Disaster recovery is the layer that turns a backup file into a working business again. That typically means image-based backups that can boot as a virtual machine within minutes — standing in for a failed server while it’s repaired or replaced — plus documented recovery steps so the process doesn’t depend on one person’s memory during a stressful afternoon. It also covers the practical questions a backup alone doesn’t answer: who calls whom, in what order, and how staff keep working — from home, a second location, or a temporary device — if the office itself is unavailable for a day or a week.
An untested backup is a guess
A backup job that reports “success” every night tells you the copy was made — not that it can be restored under pressure. Corrupted backup files, missed folders, and broken restore chains are common, and they’re almost always discovered at the worst possible time unless they’re tested first. A reasonable cadence is a file-level restore test monthly and a full recovery test at least once a year. This isn’t just good practice: cyber-insurance carriers are increasingly asking businesses directly about backup frequency and restore testing as part of underwriting, and “we think it works” is not an answer that holds up in that conversation.
A quick self-check
- Do you have an off-site copy of your backups?
- Is at least one copy immutable or air-gapped, so ransomware can’t reach it?
- Is Microsoft 365 (mail, OneDrive, SharePoint, Teams) backed up separately from Microsoft’s own retention tools?
- Do you know the date of your last successful restore test?
- Is there a written recovery plan — not just a backup job — that names who does what?
If you answered no to any of those, the gap probably isn’t the backup itself — it’s everything cloud backup and disaster recovery is supposed to cover around it. We’ve also written about comparing cloud backup solutions for small business owners, which is a good next read if you’re evaluating options. And since backups and ransomware protection go hand in hand, it’s worth checking both at the same time rather than treating them as separate projects.
If you’d like help turning “we have backups” into an actual, tested disaster recovery plan for your business, contact us or call 732-808-0577 to talk it through with our team.
Need hands-on help with this? See our Cloud Solutions →