Most business owners think about this the wrong way round. They ask whether they have a backup. The better question is how long the business can be stopped before it starts costing more than the fix.
Backups are one component of the answer. They are not the answer.
What actually takes a business offline
In practice it is rarely the dramatic scenario:
- Power interruption. Summer load, storms, and equipment faults. Even a brief outage can corrupt an unprotected server mid-write.
- Internet loss. Construction cutting a line is a mundane and common cause. If your phones, email, and line-of-business software are all cloud-based, one cut connection stops everything at once.
- Hardware failure. Drives fail. Usually the oldest machine, usually at the worst moment.
- Ransomware. Less frequent than the above, far more expensive.
- Human error. The most common cause of data loss overall. Someone deletes the wrong folder or overwrites a file, and nobody notices for a week.
Any plan built only around the ransomware scenario will miss the four things more likely to actually happen to you.
The two numbers that decide everything
Before shopping for any solution, answer these:
How long can you be down? (Recovery time)
Not what you would prefer. What you can genuinely absorb before losing money, customers, or a filing deadline. For some businesses that is a day. For an operation tied to a shipping window, it might be an hour.
How much data can you afford to lose? (Recovery point)
If your last backup was at 2am and the failure is at 4pm, you have lost a day of work. Everything typed since 2am is gone. For some businesses that is an annoyance. For a practice that entered forty records today, it is a serious problem.
These two numbers determine your cost. Tolerating a day of downtime and a day of data loss is inexpensive. Needing to be back in an hour with fifteen minutes of loss costs considerably more. Both are legitimate. The mistake is not deciding, then discovering your answer during an actual outage.
A backup that would survive the event
The old rule still holds up. Three copies of your data, on two different types of media, with one copy off-site. Modern ransomware searches for and encrypts connected backups, which means an external drive left plugged into the server it protects is not a real safeguard.
What matters most:
- Off-site or cloud copy that a compromised machine cannot reach and delete.
- Versioning, so you can go back to before the problem started. If your only copy is a mirror of current state, it faithfully mirrors the encryption too.
- Coverage of everything that matters, including Microsoft 365. Many businesses assume Microsoft backs up their email and files. Microsoft protects its infrastructure; retention of your data after deletion is limited, and third-party backup is generally recommended.
The step almost everyone skips
Restore something. This week.
Not a report saying the backup completed. An actual file, actually pulled back and opened. Then write down that you did it and when.
Backups fail silently more often than people expect. A job that has been reporting success for eight months can be backing up an empty folder because a path changed. The only way to know is to test, and the worst possible time to discover the problem is the morning you need it.
Quarterly is a reasonable cadence for most small businesses. Annually is better than never.
Continuity is more than data
Getting files back does not restart a business. A workable plan also answers:
- Where do people work if the office has no power? Can staff work from home, and has anyone confirmed that actually functions?
- How do calls reach you? Cloud phone systems can usually forward to mobiles, but only if someone knows how and has access.
- Who decides and who calls whom? A short contact list, kept somewhere reachable when the network is down. On paper is fine.
- What is the fallback for critical work? Some processes have a manual version for a few hours. Knowing which is worth an afternoon of thought.
A one-page plan
You do not need a binder. One page, kept current, covering:
- The three systems the business cannot operate without
- Your acceptable downtime and data loss for each
- Where backups live and who can restore them
- Contacts: internet provider, IT support, phone system, key software vendors, with account numbers
- How staff work remotely, and how it gets switched on
- Who makes the call and who notifies customers
Print it. A plan that only exists on the server you cannot reach is not a plan.
Common questions
What is the difference between backup and business continuity?
Backup is a copy of your data. Business continuity is the plan for continuing to operate during and after a disruption, covering where staff work, how calls are answered, and which processes have a manual fallback. Backup is one part of continuity, not a substitute for it.
How often should backups be tested?
Quarterly is a reasonable cadence for most small businesses. The test must be an actual restore of a real file, not simply confirming the backup job reported success.
Does Microsoft 365 back up my data?
Microsoft protects its own infrastructure, but retention of deleted items is limited and it is not a substitute for backup. Third-party backup for Microsoft 365 is generally recommended.
What is the 3-2-1 backup rule?
Three copies of your data, on two different types of media, with at least one copy stored off-site and out of reach of a compromised machine.
Somewhere to start
If this feels like a large project, it is not. Start by answering the two numbers, then restore one file. That afternoon will tell you more about your actual risk than any assessment.
If you want a second set of eyes, call 956-849-6174 or get in touch. We help businesses across Laredo and Webb County with backup and recovery, in English and Spanish, without long-term contracts.