It's usually a laptop that goes missing from a car, or a server hard drive that just stops spinning one Monday morning, or an employee who clicks the wrong attachment and watches every file on the shared drive get encrypted by evening. In most of these stories, there was a backup. It just didn't help — it was on the same drive, it hadn't run in months, or nobody had ever actually tried restoring from it.
Backup and disaster recovery sound like the kind of thing you deal with "at some point." In practice they're one of the few IT decisions where the cost of being unprepared is almost always higher than the cost of being ready. This post lays out what the two terms actually mean, the mistakes we see most often in small businesses here, and what a reasonable setup looks like without overspending on it.
Backup and Disaster Recovery Are Not the Same Thing
Backup is a copy of your data, kept somewhere a single bad event can't also destroy it. Disaster recovery is the plan for what happens next — which systems come back first, who does what, and how the business keeps functioning while things are being restored. You can have decent backups and still have no disaster recovery plan, because nobody has decided what "day one after the outage" actually looks like.
Most small businesses we talk to have some version of backup, even if it's thin. Very few have written down what they'd actually do if the main system was down for a full business day.
What Counts as "Backup" and What Doesn't
A folder on the same PC, an external hard drive sitting next to that PC, or a USB stick in someone's drawer are all better than nothing — and all fail at exactly the moment you need them. Theft takes the laptop and the drive together. A fire or a flood doesn't spare the backup sitting beside the machine. Ransomware actively looks for anything connected and reachable, including a mapped backup drive, and encrypts that too.
A real backup has to be able to survive the same event that destroys the original. If it can't, it's a convenience copy, not a backup.
The 3-2-1 Rule, Without the Jargon
It's one of the few IT rules of thumb that's actually simple: keep 3 copies of anything that matters, on 2 different types of storage, with 1 copy kept offsite or offline, so that no single event — theft, fire, a failed drive, ransomware — can take out every copy at once.
For a typical small business here, that usually means: the live data on the office PC or server, a local backup to a separate drive or NAS, and a cloud or offsite copy that isn't permanently connected to the main network. Accounting records, customer and order data, email, invoices and GST filings, and whatever runs the website or CMS are the obvious candidates — the things that would actually hurt to lose or be without for a week.
Recovery Point and Recovery Time, in Plain Language
Two questions decide how much backup actually costs, and most businesses have never asked either one deliberately.
Recovery Point Objective (RPO) is how much work you can afford to redo. If backups run nightly and something fails at 4pm, you've lost the day's entries. For most small businesses, that's annoying but survivable for general files, and not survivable for live order or payment data.
Recovery Time Objective (RTO) is how long the business can tolerate being down. An hour without email is different from a day without the system that takes customer payments. Not every system needs the same answer — deciding that upfront, system by system, is how you avoid paying for enterprise-grade recovery on files nobody touches twice a year.
The Mistakes We See Most Often
- A backup that's never been tested. A job can report "success" for months while quietly backing up the wrong folder, or a corrupted file. The only way to know it works is to actually restore something from it.
- One backup, physically next to the original. Same shelf, same office, same risk.
- No owner. It was set up by someone who's since left, and nobody currently knows if it's still running.
- No plan for ransomware specifically. A backup that's always connected to the network can be encrypted right along with everything else.
- Backing up the device, not the data that matters. The laptop gets imaged, but the cloud accounting export, the website files, or a key supplier's shared folder get missed entirely.
What a Reasonable Setup Actually Looks Like
It doesn't need to be elaborate. It needs to be automatic, not remembered; it needs at least one copy offsite or in the cloud; it needs at least one copy that ransomware can't reach the moment it's inside the network; and it needs a restore that's actually been tested, not just a job log that says "completed." On top of that, a one-page plan — who does what, in what order, if the main system is down tomorrow morning — turns a stressful day into a manageable one.
How TekyTec Approaches It
We start by finding out what currently exists, not what people assume exists — that's usually where the first surprise shows up. Then we test an actual restore, because a backup nobody has recovered from is still a guess. From there we size the setup to what the business genuinely can't afford to lose, through database backup and recovery and ongoing DevOps and infrastructure support, inside the same vendor-neutral approach we bring to broader IT consulting.
If you're not sure your current backup would actually get you running again, tell us what you have in place. We'll give you a plain answer.
Frequently Asked Questions
How often should backups run?
It depends on how much work you can afford to redo. Daily is the usual minimum for active business data such as orders, invoices and email. Anything that changes hourly, such as a live order system, may need more frequent backups than that.
Does Google Drive or OneDrive count as backup?
Partly, but sync is not the same as backup. If a file is deleted, corrupted or encrypted by ransomware, that change syncs to the cloud copy too. Real backup keeps separate, versioned copies you can roll back to, not just a live mirror.
What's the real difference between backup and disaster recovery?
Backup is the copy of your data. Disaster recovery is the plan for getting the business running again — what comes back first, who does what, and in what order — once something has gone wrong.
How do I know my backup actually works?
By testing a restore, not by checking that the backup job says it completed. A backup that has never been restored from is still an assumption.
Is disaster recovery only for large companies?
No — small businesses usually feel downtime faster, since there's less spare capacity to absorb a bad day. A plan doesn't need to be elaborate to be useful.
We don't have any of this today — where do we start?
Start by finding out what currently exists and confirming where your actually critical data lives, before buying any new tool. Most businesses are surprised by what that first check turns up.