Backup is not the same as disaster recovery.
A business can have perfect backups and still be down for two weeks. This is why.
Most businesses that have been through a bad week did not lose their data. They had it the whole time. What they did not have was a plan for the order in which to bring things back, and that is the difference between a backup and a disaster recovery capability.
The distinction, plainly
A backup is a copy of your data. Disaster recovery is the tested plan for getting the business working again, which includes the data but also the systems, the order things come back in, who does what, and how long it takes.
A business can have perfect backups and still be down for two weeks, because nobody had worked out what to restore first. The data was never the constraint.
The question nobody asks until it is too late
Not when did the backup last run. When did somebody last restore from it.
A backup job can report success every night for a year while quietly writing files that cannot be read back. The report is generated by the same software doing the writing, which is why it is not evidence. A restore should be tested at least quarterly, to a usable state, and the result recorded. The only evidence a backup works is a file somebody has opened after restoring it.
Microsoft does not back up your Microsoft 365 data
Not in the way most businesses assume. Microsoft guarantees the availability of its service and protects against its own infrastructure failures. That is a real commitment and it is not the same thing.
It does not protect you against a staff member deleting a mailbox, ransomware encrypting SharePoint, or a departing employee wiping a OneDrive, beyond limited retention windows that expire. Independent third-party backup covers that gap. This surprises people more often than any other item on this list.
The baseline, and the modern addition
The 3-2-1 rule means keeping three copies of your data, on two different types of storage, with one held off site. It is the baseline most insurers and auditors expect to see.
The modern addition is that one copy should be immutable, meaning it cannot be altered or deleted even by an administrator account. Ransomware now deliberately targets backups first, so a backup an administrator can delete is a backup an attacker can delete. Immutability is the single most valuable thing most businesses could add to what they already have.
How long recovery actually takes
It depends entirely on what was prepared beforehand, which is the honest answer and the uncomfortable one.
With tested backups, an immutable copy and a documented recovery order, a small business is typically working again within one to two days. Without those, recovery is measured in weeks, and some of the data does not come back at all. The gap between those two outcomes is decided months earlier, on an ordinary day, by whether somebody did the boring work.
What to do about it this month
Ask for a restore test with a date on it. Ask whether any copy is immutable. Ask what the recovery order is, and whether it is written down anywhere other than in one person's head.
If the answers are vague, the free health check is thirty minutes and covers exactly this ground. You keep the report either way.
A free dark web scan
and thirty minutes.
We scan for your company email addresses, passwords and customer data in the places stolen and leaked data gets traded, then spend thirty minutes walking you through what came back and what it actually means. No pressure, no jargon, no obligation. You keep the report either way.
Worried about what it takes to move?
Changing IT provider is the single biggest reason businesses stay somewhere they have outgrown. We plan the move around your working week, and we help carry the cost of getting across. Ask us how that works when we speak.