Ask most owners what happens if everything goes down tomorrow and you get a reasonable answer: we have backups.
It is a fair answer, and about a third of the picture. The other two thirds are the part nobody much enjoys thinking about, which is probably why it waits. So here is the short version: four decisions worth making, none of which asks you to understand the technology.
1. It starts with two numbers, not a product
What Is a Disaster Recovery Plan (DRP)?
What it comes down to. A disaster recovery plan is not something you buy. It is two numbers and a running order: how much data you could afford to lose, and how long you could afford to be shut. Answer those and the technology, the cost and the supplier all follow. Answer them the other way round and you buy something and hope it fits.
The bit that is easy to miss. Most businesses have never set those two numbers, which is not a failing. It just means they were set by default, by whatever was installed at the time. Insurers increasingly want a documented, tested plan too, before they will price cyber cover properly.
If you want to act on it. Try writing your two numbers down. "We could lose a day" and "trading again by lunchtime" is a good starting pair. Then have a think about which three systems come back first, and who makes that call if you are on a plane.
2. Three copies, two kinds of storage, one somewhere else
Data Backup and Recovery Strategies: An Overview
What it comes down to. The 3-2-1 rule has outlasted every product that claimed to replace it. Three copies of your data, on two kinds of storage, one somewhere else entirely. Deliberately boring, and boring is the point: it survives the one event that takes out everything in a single building.
The bit that is easy to miss. If you already back up, the backup is rarely the problem. It is that nobody has ever restored from it, so the first real test turns out to be the emergency. On a dashboard, a backup that restores badly looks exactly like one that works.
If you want to act on it. You do not need to know a full backup from an incremental one. Just one answer is worth having, and it is fair to ask whoever looks after your systems: when did we last restore something, and how long did it take? If that is not a date and a duration, ask whether a restore test can be scheduled. Most providers are glad to book one in.
3. Off site is the whole point, and there is one honest catch
How to Secure Your Business with Cloud Data Backups
What it comes down to. The off-site copy is the one that earns its keep. It gets you through the things that take out a whole premises: fire, flood, theft, and ransomware that reaches every machine at once. Melbourne rarely sees a natural disaster, but plenty of the surrounding area is flood and bushfire country, and ransomware does not care where you are.
The bit that is easy to miss. Cloud-only backup has a weakness worth being straight with you about. Backing up and restoring both lean on your internet connection, and a power cut can take the local hardware down too. Which is why the practical answer is usually a hybrid: a local copy for speed, a remote copy for survival.
If you want to act on it. Think of the one system you cannot trade without, then ask what restoring it looks like on a day when the internet is down as well. What you are hoping to hear is that there is a copy on site that can be restored without a connection.
4. Losing data and leaking data are not the same problem
What it comes down to. Backups answer "we lost it". They do nothing about "it left". Data loss prevention is the other half: rules and tooling that notice sensitive information heading somewhere it should not, whether that is a customer list on a personal email address or a pricing spreadsheet syncing into somebody's own cloud account.
The bit that is easy to miss. The part growing fastest is shadow data, meaning information the business holds that nobody responsible for the systems knows exists. It builds up innocently: an export taken for a one-off report, a spreadsheet that turned into a process, a trial nobody got round to cancelling.
If you want to act on it. Start with the information, not the software. What three things would hurt most if they walked out the door? Usually some mix of customer records, payroll and pricing. Then one question is worth asking, because a lot of Microsoft 365 plans already include this: does our licence cover sensitivity labelling and alerts on external sharing? Quite often it does.
In Summary
If you would rather not carry all that around:
- Two numbers: how much data you could lose, and how long you could be shut.
- The three systems that come back first, and who decides.
- A restore test, with a date and a stopwatch on it.
- The three kinds of information that would hurt most if they left.
None of those needs an IT person, and none takes long. What they do is change what your provider is able to do for you, which is usually the bit that has been missing.
Three ways to stay informed
Take the ones you want, leave the ones you don't. Free resources for your SMB.
- The IT Essentials Digest (monthly) This one. A single business focus, four of our best articles, condensed into a four-minute read: the key insight from each, what you might be missing, and how to apply it to your own business.
- InTech News (every second Wednesday) Five things worth two minutes of your time. Something interesting, something on security, Microsoft, Apple, and one practical thing a Melbourne business owner can act on.
- Blog posts (every 2-3 weeks) An email whenever we publish. Longer pieces, one subject at a time, written for owners rather than IT departments.
To start getting any of these, choose your emails. It takes a few seconds, and you can change your mind any time.
Next issue: The four ways small businesses actually get breached.
Something you would like us to cover? Tell us. We read them all.
1300 InTech, Ringwood VIC. We look after IT for small and medium businesses across Melbourne. 1300 468 324.
