A lot of SMBs have backups. A lot of SMBs don’t have disaster recovery. They’re not the same thing, and finding out the difference during a ransomware attack is the wrong time.
What Each One Actually Does
Backup is about the data. Snapshots, copies, point-in-time captures of your files, databases, and systems. Backups answer the question: do we still have the data?
Disaster recovery is about the business. Systems, applications, processes, the order things get restored in, who does what. DR answers a different question: how fast can we run again?
You can have backups and no DR. That means your data exists somewhere, but you have no plan for getting your operations back up. Two weeks of downtime while you figure it out is technically “recoverable.” It’s not recovery.
Where SMBs Get Backup Wrong
The classic mistakes show up over and over.
- Backups that live in the same environment as the production data. If ransomware hits, both get encrypted.
- Backups nobody tests. The first time you find out your restore doesn’t work is during the incident.
- Backups that cover files but not configurations, so even after restoring data, you spend three days rebuilding the systems around it.
- Backups that don’t reach back far enough. Some ransomware sits dormant for weeks before activating. A backup from yesterday is already infected.
What Good Looks Like
The 3-2-1 rule still holds. Three copies of your data, on two different media, with one offsite. Add immutability — backups that can’t be deleted or modified, even by an admin account, for a defined retention period. That’s what stops ransomware from killing your recovery option.
Test restores quarterly at minimum. Pick a system, restore it, document how long it took, what broke, what you’d do differently. Most SMBs have never done this.
What Disaster Recovery Actually Requires
A list of critical systems, ranked by how long the business can survive without each one. Your email, your finance system, your CRM, your file shares — none of these come back at the same speed, and trying to do everything at once usually means doing everything badly.
RTO — recovery time objective — is how long you can survive without a system. RPO — recovery point objective — is how much data you can afford to lose. Different systems have different numbers.
A real DR plan names people. Who calls the IT provider? Who notifies customers? Who handles the bank? Improvising those roles during the incident wastes the first day, which is also the most expensive day.
This is the kind of planning that should sit inside your broader IT services engagement — not as a one-time project, but as something that gets reviewed and tested regularly.
One Final Thing
Cyber insurance carriers now ask about backups, immutability, and tested recovery. Not having the documentation moves your premium. Having it ready makes the conversation easier and the renewal cleaner.
Defensible helps SMBs build backup and recovery programs that work under pressure, not just on paper. Talk to an expert.
