Backup versus disaster recovery: having copies is not the same as being able to recover

Two numbers that define recovery

Agree both numbers for each important system with the people who run the business, not only with IT.

• Recovery point objective (RPO): how much recent data you can afford to lose. Daily backups mean up to a day of lost orders or emails.
• Recovery time objective (RTO): how long you can be without the system. Restoring a large database from remote storage can take hours.

Backup configured versus recovery tested

We describe every system as one of two conditions. “Backup configured” means a job runs and produces files. “Recovery tested” means someone has restored those files to a working system recently and confirmed the data was complete and usable.

Only the second condition tells you that you can recover. Backups fail silently for many reasons: the wrong folders are selected, the database is copied while it is being written to, encryption keys are lost, or storage fills up.

What a sensible SME setup looks like

• At least one copy stored separately from the production system and its administrator accounts, so ransomware or a compromised admin cannot delete everything.
• Cloud services such as email and file storage backed up separately. Provider retention is not a backup policy.
• Encryption of backups at rest, with the keys stored where you can reach them during an incident.
• A scheduled restore test, at least for the most important systems, with results recorded.
• A short written recovery procedure that someone other than its author has followed.

Questions to ask your provider

• Which systems are backed up, how often, and where are the copies stored?
• When was each one last restored as a test, and by whom?
• How long would a full restore of our main system take?
• Who can delete backups, and is that access protected by MFA?

Learn more