Backups Are Not Disaster Recovery: What Your SMB Actually Needs
A backup is a copy. Disaster recovery is the plan that makes that copy usable when everything is on fire. Here's how to tell the difference — and what an SMB should actually verify before it's too late.
Most small businesses that have a backup don't have disaster recovery — they just don't know it until the worst day. The distinction matters more than it sounds, and it's the difference between a bad afternoon and a business-ending event.
A backup is a copy; recovery is a plan
A backup answers one question: "Is there a second copy of this data somewhere?" Disaster recovery answers a much harder one: "How fast can the business run again after this is gone, and who makes that happen?" You can have perfect backups and still be down for a week if no one has rehearsed the restore, knows the order, or owns the decision to fail over.
The three things a backup alone doesn't give you
- A recovery time you've actually measured — an untested restore time is a guess, and at 2 a.m. on a Monday, guesses get expensive.
- A priority order — not everything comes back at once. If email and phones are down, no one cares that the marketing drive is still copying.
- Isolation from the thing that broke the primary — if your backup sits on the same server, in the same domain, with the same ransomware, it isn't a backup. It's a second victim.
What real disaster recovery looks like for a 5–50 person team
You don't need an enterprise runbook. You need four things, written down:
- RTO and RPO targets — how long you can be down (Recovery Time Objective) and how much data you can lose (Recovery Point Objective). For most SMBs, "down by morning, lose less than a day" is a realistic and defensible target.
- Named owners — who declares the disaster, who triggers recovery, who verifies the restore is clean. If every one of those is the same person, name a backup for when they're unreachable.
- Immutable, off-site copies — a backup ransomware can't reach is the only kind that actually saves you. Immutability means the data can't be encrypted or deleted for a set window, even by an admin.
- A tested restore in the last 90 days — a restore you've never run is a hope. A quarterly test is the line between "we have backups" and "we can recover."
The 3-2-1 rule, and why it's the floor
Three copies, on two media types, with one off-site. It's the baseline that's survived for a reason. For modern SMBs, add one more: one copy air-gapped or immutable. That single addition is what turns 3-2-1 from "resilient" into "ransomware-survivable."
How an MSP changes this math
A managed IT provider runs this for a living. That means the copies are verified daily, the immutability is configured correctly, and the restore gets rehearsed before it's an emergency — usually silently, in the background. You find out your recovery works on a Tuesday afternoon, not at 2 a.m. on a Monday. That's the whole point of having it managed instead of hoped for.
If you can't answer "how long would it take us to be back up, and who's doing it?" in one sentence, you have a backup, not a plan. That's the gap we close for every SMB we onboard at amea IT.