Most businesses have some form of backup. Many therefore assume they're prepared for the worst. But backup and disaster recovery are two different things, and confusing them can be costly on the day something truly goes wrong.

What's the difference?

A backup is a copy of your data. It's your safety net if a file is deleted by mistake, a database becomes corrupted, or a hard drive fails. Backup is about data, not about systems, configurations, or the time it takes to come back online.

A disaster recovery plan (DR plan) is a complete set of procedures for how your entire IT infrastructure is restored after a serious incident: a ransomware attack, a fire, power damage, or a server failure. A DR plan describes not just what needs to be recovered, but who does what, in which order, and within what timeframe.

Simply put: backup is one of the tools in a DR plan, but it's far from the whole picture.

Remember: A backup you have never tested isn't a backup. It's a hope. Studies show that up to 30% of backup recovery attempts fail the first time, because the procedure has never been practiced in real life.

RTO and RPO: two metrics that define your needs

To know what you need, you must understand two key concepts:

RTO: Recovery Time Objective is the maximum amount of time your business can accept being down. If you run an online store, the answer might be 2 hours. If you're an internal administration department, it might be 24 hours. RTO determines how quickly your recovery system needs to be able to respond.

RPO: Recovery Point Objective is the maximum data loss you can accept, measured in time. If you back up once a day, your RPO is 24 hours: you risk losing up to a full day's work. If you back up every 15 minutes, your RPO is 15 minutes.

A concrete example: An engineering firm with ongoing projects all day has an RPO requirement of no more than 1 hour. This requires frequent, automated backup to an external location, not a nightly backup to a USB drive in a drawer.

When is backup enough, and when is a DR plan necessary?

Backup alone may be sufficient if your business can tolerate extended downtime, your systems are straightforward to rebuild, and you don't have critical business processes that require high availability. This might apply to a sole proprietorship or a business with very few digital dependencies.

A full DR plan is necessary if:

  • Downtime of more than a few hours has direct revenue impact
  • You have customers or contracts with SLA requirements for availability
  • You process personal data or are subject to regulation (GDPR, NIS2, etc.)
  • Your IT infrastructure is complex with servers, databases, and integrations
  • You have previously experienced attacks or serious outages

Self-assessment: Are you ready?

Use this checklist to assess your current situation:

  • I know exactly when my latest backup was taken and what it contains
  • My backup is stored offsite or in the cloud, not just locally
  • I have tested a recovery within the last 6 months
  • I have documented who to contact and in what order in the event of an outage
  • I know my business's RTO and RPO
  • My employees know what to do if IT fails

If you can check all the boxes, you're in good shape. If some are missing, it's worth discussing what a basic DR foundation would cost to establish.