Cloud · 5 min read
Backups are not a disaster recovery plan
Why having backups is not the same as being able to recover, and the four things that turn copies of data into a tested recovery capability.
· Bhargava Group
Ask most businesses whether they are protected against a serious outage and the answer is some version of “we have backups.” It is a reasonable instinct and an incomplete answer. Backups are copies of data. Recovery is the ability to put a working business back together within a time you can afford.
The gap between the two is where outages become crises.
Start with two numbers
Recovery Time Objective (RTO) is how long a service can be down before the damage becomes unacceptable. Recovery Point Objective (RPO) is how much data you can afford to lose, measured in time.
An online store in peak season might tolerate an hour of downtime and five minutes of lost orders. An internal file share might tolerate a day. Those numbers drive every design decision that follows, and they are business decisions — not IT ones.
Four things that turn backups into recovery
1. Coverage you have verified
List every system that matters — including SaaS platforms, configuration, DNS and identity — and confirm each is backed up. Microsoft 365 and similar services keep your data available, but retention and point-in-time recovery for your own mistakes are usually your responsibility.
2. Copies an attacker cannot reach
Ransomware targets backups first. Keep at least one copy that is immutable or offline, stored separately from production credentials.
3. A runbook someone else can follow
Recovery steps, dependencies and contacts, written down and stored somewhere that still works when your main systems do not.
4. Regular restore drills
A backup that has never been restored is a hypothesis. Rehearse restores on a schedule, time them against your RTO, and fix whatever slowed you down.
Where to begin
Pick your three most important systems, agree their RTO and RPO with the business owners, and run one restore test for each this quarter. The results will tell you more about your resilience than any audit.
Our Cloud & Infrastructure practice designs and runs recovery programmes, from backup policy to full disaster recovery drills.