Backup and Disaster Recovery: A Practical Guide for Small and Medium Businesses

In Depth

In Depth

Disks fail, laptops are stolen, files are deleted and ransomware encrypts what it can reach. With good backups a business loses a few hours; without them it can lose years of records. This guide covers what to back up, how to protect the copies and how to plan the recovery.

Note Extrion provides backup and disaster recovery services and earns from them. No vendor paid for or reviewed this guide.

Backup and disaster recovery are not the same

• Backup is a copy of your data that you can restore.
• Disaster recovery is the plan for getting the business working again: which systems come back first, on what equipment, by whom and how long it may take.

You need both. A backup that nobody knows how to restore is little help on the day.

List what matters

Write down the data and systems the business cannot work without, for example:

• Accounting and payroll data
• Customer, patient or guest records
• Business software databases
• Shared files and documents
• Email and calendars
• Website files and database
• Configuration of servers, firewalls, switches and CCTV recorders

For each one, note who owns it and where it lives today: a laptop, a server in the office or a cloud service. Anything that lives only on one laptop is your biggest risk.

Decide how much you can afford to lose

Two questions guide the design. IT people call the answers RPO and RTO:

• How much work could you redo? (recovery point objective, RPO) If losing a day of entries would be painful, back up at least daily. If an hour would be painful, back up more often or continuously.
• How long can you be without it? (recovery time objective, RTO) If a system must be back within hours, plan the equipment and steps in advance rather than buying a replacement after the failure.

Different systems get different answers. Accounts may need daily backups and a one-day recovery; a sales database may need hourly copies and a recovery within the morning.

Follow the 3-2-1 rule, and keep one copy offline

The UK National Cyber Security Centre describes the 3-2-1 rule as at least three copies of your data, on two different devices, with one off site. It adds that 3-2-1 on its own does not require any copy to be offline, so it recommends keeping at least one backup offline at any time: then an incident cannot affect all your backups at once (NCSC: Offline backups in an online world).

In practice, that often means:

• The original, on the server, computers or cloud service.
• A local backup device, such as a NAS in another room, for fast restores.
• An off-site copy, in a cloud backup service or another building, in case the office suffers fire, flood or theft.
• One copy ransomware cannot change: a disconnected drive that is rotated, or backup storage that keeps earlier versions and cannot be overwritten or deleted from the office network.

Protect the backups themselves

• Use separate accounts for the backup system, with strong passwords and multi-factor authentication. Ransomware often uses stolen administrator accounts to delete backups first.
• Do not leave backup drives permanently connected to everyday computers.
• Encrypt backups that leave the building, and store the encryption key safely somewhere else.
• Keep the backup device and the network cabinet on a UPS so a power cut does not corrupt a backup in progress. Frequent power cuts make this essential.

Test restores

A backup is only proven when you restore from it, and NCSC advises testing backups regularly. Each month, pick a file, a mailbox or a whole system and restore it to a test location. Write down how long it took and what went wrong. Restoring over a slow internet link can take far longer than people expect, so time an off-site restore at least once.

Cloud services still need backups

Files synchronised to a cloud drive are convenient, but a deleted or encrypted file is synchronised everywhere. Check how long the service keeps deleted files and earlier versions, and consider a separate backup of important cloud data such as email and shared drives. Our guide to cloud vs local hosting covers this choice in more detail.

Note If an off-site backup holds customer, patient or staff records and is stored outside Tanzania, the Personal Data Protection Act, 2022 rules on transfers abroad may apply, and the PDPC asks organisations to apply for a transfer permit first. Ask a legal adviser if you are unsure. This is not legal advice.

Write a short recovery plan

Keep it short enough that people will read it:

1. Who to call, with phone numbers that do not depend on the office systems.
2. The order in which systems are restored.
3. Where the backups are and how to reach them, with passwords stored securely away from the systems themselves.
4. What staff do in the meantime, such as paper forms or a temporary workspace.
5. When the plan was last tested, and by whom.

NIST's Contingency Planning Guide for Federal Information Systems (SP 800-34 Rev. 1) is a detailed public reference if you want to go further. For protecting systems before anything goes wrong, try our cybersecurity checklist.

When to call Extrion

If you want backups set up, checked or tested, see our backup and disaster recovery service, our managed IT support, or contact us.

This guide is general information. Procedures, product features and firmware change, so check your own equipment's documentation before you start.