Backup vs. Disaster Recovery for a Small Business
“We have backups” answers one question. The question that matters after a flood, a ransomware note or a dead server is a different one: how long until we're working again, and how much did we lose?
Most small businesses have a backup and assume it gives them a recovery. The two are related the way a spare tire is related to getting home: necessary, and not the same thing. The gap usually shows up on the worst possible day, when the backup is fine and the office is still down for a week because nobody had planned where to restore it to.
The Short Version
Pick two numbers. How much work can you afford to lose, measured in hours since the last backup? How long can you afford to be down, measured in hours until you're working again? Every backup decision falls out of those two, and if your current setup can't state them, it's a copy, not a plan.
The Two Numbers
| Term | Plain English | Typical small business | What moves it |
|---|---|---|---|
| Recovery Point Objective (RPO) | How much work you can lose | A day for files; an hour for the line-of-business database | How often the backup runs |
| Recovery Time Objective (RTO) | How long until you're working again | Hours for a workstation; a day or more for a server | Whether you restore to existing hardware, new hardware or the cloud, and whether anyone has practiced |
A nightly backup of the server gives you an RPO of up to 24 hours. Restoring that server onto replacement hardware you don't own yet gives you an RTO measured in days, however good the backup is. Ask your provider for both numbers. If they can't answer, that is the answer.
Kinds of Backup, and What Each Is For
| Type | What it captures | What it restores | Notes |
|---|---|---|---|
| File backup | Selected folders | Individual files | What most people have. It can't rebuild a machine. |
| Image backup | The whole machine: system, programs, settings, files | A full machine, onto the same or different hardware | The one that shortens RTO. Standard on servers. |
| Continuous cloud backup | Files, versioned, every few minutes | Files and their prior versions | Included on every Bay Geeks plan for workstations. See home backup strategy. |
| Managed server backup | Images and application-aware copies, on-site and off-site | A whole server, quickly | See managed server backup. |
| SaaS backup | Microsoft 365 or Google Workspace mail, files, Teams | Deleted or encrypted cloud data | The one businesses assume the vendor does. |
Why the Cloud Apps Still Need a Backup
Microsoft and Google keep the service running; they don't promise to keep the copy you need. Deleted items are recoverable for a while and then gone. A departing employee's OneDrive follows their license out the door. And the sync client is the fastest way ransomware has ever found to spread: it dutifully uploads the encrypted versions, and version history helps only as far back as it goes. The phrase in the contract is shared responsibility. They run the service; you protect the data.
3-2-1, Plus One and Zero
The home version of the rule says three copies, on two kinds of media, with one off-site. For a business add two more numbers: one copy that's immutable or offline, so ransomware and a careless administrator can't touch it, and zero errors on a verified restore. Immutable means the backup service will not let anyone, including you, delete or change that copy for a set period. It's the difference between a backup ransomware crews hunt for first and one they can't reach.
What Disaster Recovery Adds
- A priority order. Email, then the line-of-business app, then files, then phones. Written down, so nobody argues about it at 6 a.m.
- A place to restore to. Spare hardware, a cloud instance you can spin up, or a provider who supplies it.
- A call tree. Who declares the disaster, who calls the insurer, who talks to customers.
- A storm version of all of it. See the hurricane season checklist.
- A test date on the calendar that actually happens.
Testing Without Losing a Weekend
- Monthly: restore one random file from last week. Two minutes.
- Quarterly: restore a full image to a spare machine or a virtual machine and boot it. Time it. That time is your real RTO.
- Yearly: walk through the call tree over lunch as a tabletop exercise.
- Write the results down. An auditor, an insurer and your future self will all ask.
What Downtime Costs
A five-person office losing a day is five people's wages for a day, plus the revenue that didn't happen, plus the customer who went elsewhere. Against that, the difference between a file backup and a managed image backup with an off-site copy is a modest monthly line. The math usually isn't close. It just doesn't get done until after the first bad day.
Quick Self-Check
| Question | If “no” or “not sure”... |
|---|---|
| Can you state your RPO and RTO in hours? | Decide them this week |
| Is there an immutable or offline copy that ransomware can't reach? | Worth a call |
| Is Microsoft 365 or Google Workspace backed up separately? | Almost certainly not |
| Has a full restore been timed in the last year? | Do it this quarter |
Put Numbers on It
Managed server backup with on-site and off-site copies, an immutable layer, and a tested restore, so the two numbers are yours and not a guess.
Frequently Asked Questions
Is OneDrive or Google Drive a backup?
No. It's sync. Whatever happens to the file on your machine, including encryption by ransomware, happens to the copy in the cloud a few seconds later, and version history only reaches back so far.
Is RAID a backup?
No. RAID protects against a single drive failing. It copies a deletion or an encryption faithfully to every disk in the set.
How often should we test a restore?
A single file monthly, a full image quarterly, and again after any change to the backup system. The quarterly test is the one that tells you your real recovery time.
We're fully in the cloud. Do we still need disaster recovery?
A smaller one, yes. A backup of the cloud data itself, and a plan for the laptops, the internet connection and the phones, which are the parts that still break.
What does immutable mean?
The backup copy can't be deleted or altered by anyone for a set period, not even an administrator with the right password. It's the copy ransomware can't reach, and the one insurers now ask about by name.
More Guides
What managed server backup covers, and why a file server is not a workstation.
The 3-2-1 rule, what ransomware changes about it, and the set-and-forget version.
The proactive steps that keep your business off the list of victims.
Before the storm, during the outage, and the surge on the way back up.
What carriers ask about MFA, backups and EDR, and how to get to an honest yes.
What to do (and what to stop doing) when a drive starts clicking.
📞 727-579-4335 · ✉️ support@baygeeks.com · Privacy Policy · Terms of Service