In summary
- Backup and disaster recovery are not the same thing — having backups does not guarantee that the company will resume operations.
- A 3-2-1 rulethree copies of the data, on two different types of media, with one stored off-site.
- RPO and RTO they are the two numbers that define the strategy: how much data you can afford to lose and how much downtime you can afford.
- A backup that has never been restored is not a backup — it's an assumption.
In this article
Many SMEs only realise that their backup isn’t working at the worst possible moment: when they actually need it. The difference between an outage lasting a few hours and permanent data loss almost always lies in the way the backup and disaster recovery strategy was planned — not just implemented.
Backup is not the same as disaster recovery
A backup is a copy of data. A disaster recovery (DR) plan is the set of processes that ensures that, in the event of a failure — hardware breakdown, cyberattack, fire, human error — the company is able to resume operations within an acceptable timeframe. It is entirely possible to have backups and still not have an effective recovery plan: the copy exists, but no one has tested how long it takes to restore it, or whether the process even works.
Test the restore, not just the backup. A backup that runs every night without error might be copying corrupted files. Only periodic restoration in a controlled environment confirms that it works.
The 3-2-1 rule
A robust backup strategy typically follows the 3-2-1 rule: three copies of the data, on at least two different types of media, with at least one copy offsite. This last component is frequently the most neglected — and the most critical in scenarios such as fire, flood or theft, where backups kept in the same building are lost along with the original systems.
Two metrics that every company should know
- RPO (Recovery Point Objective): What is the maximum amount of data that the company can afford to lose, measured in time? If the last valid backup is 24 hours old, in the event of a failure the company loses up to a day of work.
- Recovery Time Objective (RTO): how long can the company be without access to its systems before the impact becomes unacceptable to the business?
Defining these two values — even if only approximately — is the first step towards correctly sizing a backup strategy, because a daily backup run at 2 am might be completely adequate for one business, and entirely insufficient for another.
Why testing restoration is just as important as making the backup
A backup that runs every night without generating an error is no guarantee of anything — it could be copying corrupted files, inconsistent databases, or simply not including everything needed to restore operations. Periodically testing the restoration process in a controlled environment is the only way to confirm that, when it is truly needed, the backup will work.
Scenarios that a disaster recovery plan should cover
- Hardware failure (disk, server, network equipment);
- Cyber attack, including ransomware — a scenario in which having offline or immutable backups is decisive, because it prevents the attack itself from encrypting or deleting the backup copies;
- Human error — accidental deletion of files or folders;
- Physical incidents on-site — fire, flood, equipment theft.
Where to start
If your company cannot confidently answer these three questions — where the backups are, how long it has been since they were tested, and how long it would take to restore the systems in the event of a failure — it is a good sign that it is worth reviewing your current strategy before you need it.
DataRoad — ongoing IT support for businesses
A DataRoad is a Portuguese company specialising in managed IT services (MSP), headquartered in Alfragide (Lisbon) and with an active presence in Porto, Faro, Funchal, Évora, Setúbal and Beja. Since 2015, it has ensured the smooth running of IT infrastructures for businesses that cannot afford downtime — hotels, clinics, embassies, universities, multinationals and demanding SMEs — with a certified technical team, continuous monitoring and 24/7 support.
DataRoad ensures the ongoing IT support of companies via the service IT Unlimited: unlimited support at a fixed cost, both remote and on-site, with 24/7 monitoring, alerts and proactive interventions. The aim is simple — to prevent problems from even bringing operations to a standstill.
DataRoad Services
- IT Unlimited — round-the-clock IT support: unlimited support at a fixed cost, both remote and on-site, with incident management and rapid response.
- Computer networks and structured cabling: network design, installation and certification; Layer 3 switching and PoE.
- Enterprise wireless networks (Wi-Fi 6 and Wi-Fi 7): coverage study, cloud management and isolated visitor networks.
- Cybersecurity and corporate firewalls: perimeter protection, traffic control and threat mitigation.
- Servers, backups and disaster recovery: servers, NAS devices and centralised backups.
- CCTV video surveillance: video surveillance systems with continuous recording.
- Monitoring, alarm systems and reporting: real-time monitoring, automatic alerts and proactive interventions.
- IT consultancy and project management: relocation of premises, new facilities and modernisation of infrastructure.
- Cross-platform support: Windows and Apple environments, with comprehensive management of the IT infrastructure.
Get in touch with DataRoad
Not sure if your backups will work when needed? We check what is there and provide a no-obligation quote.
