Almost every business says it has backups. Far fewer can answer two questions: how much information they would lose if the system failed right now, and how long it would take to get back to work.
Those two questions are the difference between backup and recovery.
Backup: having a copy
A backup is a copy of your data stored somewhere else. It helps when someone deletes a file by mistake, when a drive fails or when a ransomware attack encrypts your information.
What a backup does not guarantee on its own is speed. If your server burns out and the only copy is in the cloud, downloading everything, getting new equipment and reinstalling software can take days.
Recovery: getting back to work
Recovery is the full plan for the business to operate again: where the data will be restored, on what equipment, who does it and in what order. It is measured with two simple numbers.
- How much information you can afford to lose. If you back up once a day, you can lose up to a day of work. If that is too much, you need more frequent copies.
- How long you can be down. A business that can tolerate two days without its system needs something very different from one that cannot tolerate two hours.
There are no universal right answers. There is the answer that fits your operation and your budget.
The local problem: no power and no internet
In Puerto Rico there is a scenario that generic manuals do not handle well: your data is intact, but you cannot reach it.
- If everything is on a local server and there is no power, the information exists but nobody can use it.
- If everything is in the cloud and the office loses internet, the same thing happens from the other side.
- If the local backup and the server are in the same room, a flood or a power surge takes both.
That is why the practical recommendation is to combine: a local copy to recover everyday items quickly, and an off-site copy for when the problem is the whole building.
A simple rule that works
Keep at least three copies of what matters, on two different types of storage, with one of them outside the office. If one copy also cannot be modified or deleted for a period of time, it stays protected even if an attacker gets into your network.
What the cloud does not do for you
A common mistake is assuming that, because email and files are in Microsoft 365 or a similar service, they are already backed up. Those services protect their own infrastructure, but information that you delete, or that an attacker deletes with your credentials, can be lost after a certain time. For important data, a backup independent of the service is worth having.
How to know if you are well covered
- Do you know when the last successful backup ran and who verifies it?
- Has anything been restored in the last six months, as a test?
- Is there a copy outside the office?
- Do you know how long it would take to operate again if you could not enter the building tomorrow?
If any answer is "I don't know," that is where it is worth starting.
← Back to the blog