26 August 20265 minute readLANTEK Computers
Most businesses that have been through a bad week did not lose their data. They
had it the whole time. What they did not have was a plan for the order in which
to bring things back, and that is the difference between a backup and a disaster
recovery capability.
The distinction, plainly
A backup is a copy of your data. Disaster recovery is the tested plan for
getting the business working again, which includes the data but also the systems,
the order things come back in, who does what, and how long it takes.
A business can have perfect backups and still be down for two weeks, because
nobody had worked out what to restore first. The data was never the constraint.
The question nobody asks until it is too late
Not when did the backup last run. When did somebody last restore from it.
A backup job can report success every night for a year while quietly writing
files that cannot be read back. The report is generated by the same software
doing the writing, which is why it is not evidence. A restore should be tested at
least quarterly, to a usable state, and the result recorded. The only evidence a
backup works is a file somebody has opened after restoring it.
Microsoft does not back up your Microsoft 365 data
Not in the way most businesses assume. Microsoft guarantees the availability of
its service and protects against its own infrastructure failures. That is a real
commitment and it is not the same thing.
It does not protect you against a staff member deleting a mailbox, ransomware
encrypting SharePoint, or a departing employee wiping a OneDrive, beyond limited
retention windows that expire. Independent third-party backup covers that gap.
This surprises people more often than any other item on this list.
The baseline, and the modern addition
The 3-2-1 rule means keeping three copies of your data, on two different types
of storage, with one held off site. It is the baseline most insurers and auditors
expect to see.
The modern addition is that one copy should be immutable, meaning it cannot be
altered or deleted even by an administrator account. Ransomware now deliberately
targets backups first, so a backup an administrator can delete is a backup an
attacker can delete. Immutability is the single most valuable thing most
businesses could add to what they already have.
How long recovery actually takes
It depends entirely on what was prepared beforehand, which is the honest
answer and the uncomfortable one.
With tested backups, an immutable copy and a documented recovery order, a small
business is typically working again within one to two days. Without those,
recovery is measured in weeks, and some of the data does not come back at all.
The gap between those two outcomes is decided months earlier, on an ordinary day,
by whether somebody did the boring work.
What to do about it this month
Ask for a restore test with a date on it. Ask whether any copy is immutable.
Ask what the recovery order is, and whether it is written down anywhere other
than in one person’s head.
If the answers are vague, the free
health check is thirty minutes and covers exactly this ground. You keep the
report either way.