Backups and disaster recovery for SMBs - practical guide without complexity

Almost every SMB says it has backups. Few can confidently answer three questions: what gets backed up, how often, and how long it would take to operate again if everything were lost tomorrow. A backup and recovery plan does not have to be complex; it has to be written down, working and tested.

1. List what you cannot lose

• Shared folders and work files.
• System databases: sales, inventory, payroll, accounting.
• Email and cloud documents.
• Configurations of network devices, servers and systems.
• Information that lives only on some people's computers.

For each item, note where it lives, who owns it and what would happen if it disappeared.

2. Decide how much you can lose and how long you can wait

Two simple questions define the plan:

• How much data can you lose? If you back up once a day, in the worst case you lose a day of work. For sales or invoicing that may be too much; for reference documents it may be fine. The technical term is RPO.
• How long can you be down? A few hours, a day, a week. This defines whether restoring files is enough or whether you need a standby device or server ready. The technical term is RTO.

3. Follow the 3-2-1 rule

Three copies of your data, on two different media, with one copy off-site. Today it is worth adding two conditions: at least one copy should be offline or immutable so ransomware cannot encrypt or delete it, and backups should be verified as error-free.

4. Frequency and retention

• Critical system databases: several times a day or daily, depending on your answer in step 2.
• Work files: daily.
• Configurations: whenever they change.
• Retention: keep several versions, for example daily copies for the last few weeks and monthly copies for several months, to recover something damaged long ago that nobody noticed.

5. The cloud needs backups too

Having your email and documents in a cloud service does not mean they are backed up against everything. The provider protects its infrastructure, but an accidental deletion, a compromised account or a sync error are your responsibility. Review the backup options for your cloud services.

6. Test the restore

A backup that has never been restored is an assumption. Every quarter, restore something real: a file, a folder, a database on a test machine. Measure how long it takes and note the problems. That test is what tells you whether the plan works.

7. Write the recovery plan

One or two pages that answer:

• Who declares the emergency and who coordinates.
• In what order systems are recovered, starting with what affects customers and collections the most.
• Where the backups are and the credentials to access them, stored in a separate, secure place.
• How to operate in the meantime: manual forms, a backup point of sale or customer service.
• Phone numbers of key vendors.

Quick checklist

• List of critical information with owners.
• Automatic backups following 3-2-1 with one offline or immutable copy.
• Alerts when a backup fails.
• Quarterly restore test.
• A written recovery plan the team knows.

Common mistakes

• An external drive permanently connected to the same computer.
• Backups failing for months without anyone noticing.
• Keeping the backup password only on the machine you want to protect.
• Backing up files but not the system databases.

How we approach it at Syatek

We review which information is critical, design backups around how much you can lose and how long you can wait, and leave the recovery documented and tested. It is part of our networks and infrastructure service. If you are not sure your backups work, let us test them.