The question most owners can't answer
"Do you have backups?" almost always gets a yes. "When was the last time you successfully restored from one?" almost never does. The gap between those two answers is where most business disasters actually happen.
Two numbers that matter
Every disaster recovery plan comes down to two numbers:
An RTO of "one hour" and an RPO of "fifteen minutes" describe a very different setup than "we'll be back next week and lose a day's work." Both are legitimate answers — but you should know which one is yours before you need it.
The 3-2-1 rule, in plain English
The classic guidance still holds up: keep at least three copies of your data, on at least two different types of storage, with at least one copy off-site. In practice that usually looks like: your live data, a local backup you can restore from quickly, and a cloud copy that survives fire, theft, or ransomware on the local network.
What people overlook
Even businesses with backups tend to miss the same things:
Any one of these turns a backup into a false sense of security.
Ransomware changes the math
Modern ransomware specifically hunts backups. That's why immutable backups — copies that cannot be modified or deleted for a set retention window, even by an administrator — have become the standard. Combined with an off-site cloud copy that requires separate credentials, they give you a version to restore to that the attacker cannot reach.
Restore testing is the whole point
A backup you have never restored is unverified. Restore testing doesn't have to be dramatic. On a schedule — monthly for critical systems, quarterly for the rest — restore a file, a mailbox, a server, and time how long it takes. The first test always finds surprises. The second one usually doesn't.
Cloud, on-premise, or both
The right architecture depends on what you're protecting.
Business continuity is more than data
A full continuity plan also answers: If the office is inaccessible, where do people work? If the phone system is down, how do customers reach you? If email is offline, how do teams coordinate? Cloud identity, VoIP, and Microsoft 365 or Google Workspace make many of these questions easier than they were a decade ago — but only if that's been thought through in advance.
A simple starting point
If you can't confidently answer the "how long could we operate" question today:
That six-step exercise, done once, replaces most of the anxiety around this topic with actual answers.
Bottom line
Backups are not the goal. Recovery is the goal. The businesses that come through an incident intact are the ones who knew — in writing — how long it would take to get back up and how much they'd lose in the process, and had tested it recently enough to trust the answer.