Backup and Disaster Recovery: 8 Questions SMBs Ask

Short answer: a backup is only real if it's isolated from your network, covers everything the business needs to operate, and has been restored in a test recently. Most businesses find out theirs fails one of those three — during the worst week to find out. The eight backup and disaster recovery questions we hear most:

1. Isn't everything already in the cloud?

Sync is not backup. OneDrive and Google Drive faithfully replicate whatever happens — including deletions and ransomware encryption — to every copy. Microsoft's own model makes you responsible for backing up your data; retention settings are not restore points. See why Microsoft retention is not a backup.

2. What should we actually back up?

Everything required to run the business: files, email, line-of-business databases, accounting, configurations, and the cloud services you'd be lost without. The test: if this system vanished at 9 a.m., would today still happen?

3. How often should backups run?

Ask it as a business question: how much work can you afford to lose? That answer — an hour, a day — is your backup frequency. Critical databases usually justify continuous or hourly protection; file shares may tolerate nightly.

4. Why do ransomware victims with backups still pay?

Because their backups were reachable from the network, and the attackers encrypted them first. Modern crews hunt backups before triggering anything. Isolation — immutable cloud copies or offline copies — is what makes a backup survivable.

5. What's the difference between backup and disaster recovery?

Backup is the copy; disaster recovery is the plan that turns copies back into a running business — in what order, on what hardware, in how long. Two numbers define it: how much data you can lose (RPO) and how long you can be down (RTO). Details on our disaster recovery page.

6. How fast can we realistically be back?

Engineered right, critical systems come back in minutes to hours — we've built environments where a failed server fails over in about fifteen minutes (see the importer case study). Unplanned and untested, recoveries take days. The difference is design, not luck.

7. How do we know our backups work?

You restore them. On a schedule. With a log. Anything else is faith. Restore testing is the single strongest predictor of surviving ransomware — it's why our recovery record is what it is (methodology here). If you need that same restore evidence for an insurer, a cyber insurance readiness assessment gathers it in one place.

8. What does this cost?

A fraction of one day of downtime. Protection is priced by data volume and recovery speed; start with a 15-minute engineer call and we'll size it for your environment honestly.

Sources and further reading

• NIST SP 800-34 — Contingency Planning Guide — the reference standard for IT recovery planning.
• NIST Ransomware Protection and Response — primary-source ransomware guidance.