Managed IT Services
Backup used to mean swapping tapes on Friday afternoon and hoping they worked. Today the technology is better, cheaper, and mostly automated, yet we still meet New Jersey business owners every month who discover, in the middle of a ransomware attack or a failed server, that their backups were incomplete, out of date, or encrypted along with everything else. This backup and disaster recovery guide is written for the owner, partner, or practice manager who signs the checks and carries the risk, not for the technician.
It explains what a real backup and disaster recovery plan contains, the numbers you need to decide on, the options available to a small business in 2026, and the mistakes that turn a bad day into a closed business.
If you want the simpler starting point, our post on simple backup and recovery plans every small business needs covers the basics. This guide goes a level deeper into strategy, recovery objectives, compliance, and testing.
Backup and Disaster Recovery Guide: The Two Halves
Business owners reading a backup and disaster recovery guide often use the two terms interchangeably. They are related but different, and the difference matters when you are buying a solution.
- Backup is a copy of your data, kept somewhere separate, that you can restore from. It answers the question “do we still have the files?”
- Disaster recovery (DR) is the plan and the technology for getting your business operating again after a serious failure: a ransomware attack, a fire, a flood, a stolen server, a cloud outage, or a critical hardware failure. It answers “how fast can we work again, and from where?”
This backup and disaster recovery guide draws the line because you can have excellent backups and no disaster recovery. Many businesses do. Their files are safe in the cloud, but when the server dies it takes two weeks to buy a replacement, rebuild the applications, and restore the data, and the office is down the whole time. A complete backup and disaster recovery guide has to address both halves: protecting the data and restoring the ability to operate.
The Two Numbers That Drive Every Decision: RPO and RTO
Before you compare products in any backup and disaster recovery guide, decide on two numbers. They are the foundation of any backup and disaster recovery guide and the first thing a competent IT provider will ask you.
RPO and RTO Defined: Recovery Point Objective
RPO is how much data you can afford to lose, measured in time. If your last good backup was at midnight and the server fails at 3:00 p.m., you have lost 15 hours of work. If that is acceptable, your RPO is 24 hours and nightly backups are fine. If losing a full day of patient charting, client billing, or order entry would be a serious problem, you need an RPO of an hour or less, which means continuous or hourly backups.
Recovery Time Objective (RTO)
RTO is how long you can afford to be down. A law firm that can work from laptops and email for two days while a server is rebuilt has a 48-hour RTO. A medical practice with a full waiting room and an EHR that will not open has an RTO measured in minutes. RTO determines whether a simple cloud backup is enough or whether you need a system that can spin up a copy of your server on demand.
Write both numbers down for each critical system; RPO and RTO will be different for your file server, your EHR or practice management database, your email, and your accounting system. Once you have them, choosing technology becomes straightforward, because every option is really a trade-off between RPO, RTO, and cost.
The 3-2-1-1-0 Backup Rule
The classic 3-2-1 backup rule, three copies of your data on two different types of media with one copy offsite, is still the right starting point. Ransomware has forced this backup and disaster recovery guide to add two rules, and modern practice is 3-2-1-1-0:
- 3 copies of your data: production plus two backups.
- 2 different storage types, such as a local appliance and cloud storage.
- 1 copy offsite, so a fire, flood, or theft at the office does not take everything.
- 1 copy that is offline, immutable, or air-gapped, so ransomware that reaches your network cannot encrypt or delete it. Immutable cloud storage, where backups cannot be altered for a set retention period even by an administrator, is the practical way to do this today.
- 0 errors after verification, meaning backups are automatically tested and restores are proven to work.
The immutable copy in the 3-2-1 backup rule is the one most small businesses are missing. Attackers now routinely look for and destroy backups before they encrypt production systems, because a business with no backups is far more likely to pay. If your backup drive is permanently connected to the server, or your cloud backup can be deleted with the same credentials an attacker just stole, you do not have a ransomware recovery plan. The CISA Ransomware Guide makes the same point in its first recommendation.
What Needs to Be Backed Up (It Is More Than the Server)
A backup and disaster recovery guide written in 2023 would have focused on the file server. In 2026, your data is spread across many places, and each one needs a decision:
| Where Data Lives | Common Assumption | Reality |
|---|---|---|
| On-premises server | “IT backs it up” | Needs image-level backup, offsite copy, and a tested restore |
| Microsoft 365 / Google Workspace | “It’s in the cloud, it’s safe” | Microsoft and Google protect against their failures, not yours; deleted mail and files age out of recycle bins |
| Line-of-business SaaS (EHR, CRM, accounting) | “The vendor handles it” | Check the contract; many only restore for their own outages, and exports may be limited |
| Laptops and desktops | “Everything is on the server” | Desktops, downloads, and local folders routinely hold working files |
| Phones and tablets | Rarely considered | Photos, texts, and authenticator apps can matter in an incident |
| Website and domain | “The host backs it up” | Verify retention; keep your own copy and your DNS records |
| Configurations | Forgotten | Firewall, switch, VoIP, and application settings take days to rebuild from memory |
In any backup and disaster recovery guide for 2026, Microsoft 365 deserves emphasis because it is where most small businesses now keep email and files. Microsoft’s own shared responsibility documentation says the customer is responsible for their data. A third-party Microsoft 365 backup that captures mailboxes, OneDrive, SharePoint, and Teams with long retention costs a few dollars per user per month and closes the most common gap we find. Our comparison of OneDrive versus SharePoint for files explains where that data actually sits.
Backup and Disaster Recovery Options for Small Business
With your RPO and RTO in hand, the technology choices in this backup and disaster recovery guide sort themselves into a few tiers.
File-level cloud backup
Copies selected folders to the cloud on a schedule. It is the entry level of any backup and disaster recovery guide. Inexpensive and adequate for businesses whose applications are already cloud-hosted and who can tolerate a day or more to rebuild a machine. RPO of 24 hours, RTO of days.
Image-based backup with local and cloud copies
Captures the entire server or workstation, operating system and applications included, so it can be restored to new hardware or run as a virtual machine. Typically paired with a local appliance for fast restores and replication to the cloud for offsite protection. RPO of 15 minutes to an hour, RTO of hours. This is the standard for any business with an on-premises server.
Business continuity and disaster recovery (BCDR) appliances
Image-based backup plus the ability to boot your failed server as a virtual machine on the appliance itself, or in the vendor’s cloud, within minutes. Users keep working while the real server is repaired or replaced. RPO of minutes, RTO of under an hour. This is what a medical practice or any business with a tight RTO should be running.
Cloud-native disaster recovery
For businesses that have moved servers to Azure or another cloud, DR means replicating workloads to a second region and backing up with immutable retention. The hardware problem disappears, but the configuration and testing discipline still applies. Our Azure cloud migration services include DR design.
SaaS backup
The last tier in this backup and disaster recovery guide is dedicated backup for Microsoft 365, Google Workspace, and increasingly for other SaaS platforms, with point-in-time restore of a mailbox, a document, or a whole site. Essential for every business, regardless of the tiers above.
Building the Small Business Disaster Recovery Plan Document
Technology without a written small business disaster recovery plan fails at 2:00 a.m. when the one person who knows how it works is unreachable. A usable small business disaster recovery plan fits in a few pages and covers:
- Critical systems and their RPO/RTO, ranked by how quickly each must return.
- Who does what: who declares a disaster, who contacts the IT provider, who talks to staff, clients, and insurers, and who has authority to spend money.
- Contact information for IT, the backup vendor, internet and phone providers, the landlord, the cyber insurance carrier, legal counsel, and key staff, stored somewhere that does not depend on the systems that just failed.
- Step-by-step recovery procedures for each scenario: ransomware, server failure, office inaccessible, cloud outage, lost or stolen device.
- Workaround procedures so the business can function manually or from alternate locations during the recovery window.
- Communication templates for staff and clients.
- Compliance obligations, including HIPAA and state breach notification deadlines if data was exposed.
- Test schedule and results.
Our IT outage checklist for business is a ready-made starting point for the non-cyber scenarios, and the free templates at Ready.gov cover the broader business continuity plan.
Testing: The Step Everyone Skips
A backup that has never been restored is an assumption, and no backup and disaster recovery guide is complete without a testing schedule. Every backup and disaster recovery guide says to test, and almost nobody does, because it feels like work with no visible payoff. Then the restore fails: the backup job had been silently erroring for months, the database was captured in an inconsistent state, the cloud copy was missing a folder, or the recovery takes three days instead of three hours. Build testing into the routine:
- Daily: automated backup verification and alerting, reviewed by a person.
- Monthly: restore a sample of files and a mailbox and confirm they open.
- Quarterly: boot a server image as a virtual machine and log in to the application.
- Annually: a full tabletop exercise walking through the written plan with the people named in it, plus a full recovery test of the most critical system.
Document each test as part of your backup and disaster recovery guide records. Cyber insurers, HIPAA auditors, and FTC Safeguards Rule examiners all ask for evidence that backups work, not just that they exist.
Compliance: What HIPAA, the FTC, and Insurers Require
For regulated New Jersey businesses, following a backup and disaster recovery guide is not only prudent; it is required. The HIPAA Security Rule requires a data backup plan, a disaster recovery plan, an emergency mode operation plan, and testing and revision procedures as part of the contingency plan standard. The FTC Safeguards Rule requires safeguards that ensure the availability of customer information and an incident response plan. Cyber insurance applications ask specifically about offline or immutable backups, backup testing frequency, and MFA on backup consoles, and policies increasingly require them. Our HIPAA compliance consulting and FTC Safeguards Rule compliance services build the backup and DR documentation into the written program.
Backup and Disaster Recovery by Industry
Medical and dental practices
For a practice following this backup and disaster recovery guide, the EHR or practice management database is the system with the tightest RTO in the building; a waiting room cannot wait for a two-day rebuild. Practices on a local server should run a BCDR appliance with sub-hour recovery, and practices on a hosted EHR should confirm the vendor’s RPO and RTO in writing and keep their own export of scheduling and billing data. HIPAA’s contingency plan standard makes the backup and disaster recovery guide above a documented requirement, not a suggestion. See our healthcare IT support page.
Law firms
Document and case management systems, email, and trust accounting are the priorities, along with retention long enough to satisfy file-retention rules for closed matters. Court deadlines do not move for a server failure, so the small business disaster recovery plan should include how attorneys keep filing from laptops during recovery. Our IT support for law firms covers this.
Accounting and financial services
Tax software databases, client portals, and QuickBooks files need frequent restore points during filing season, and the FTC Safeguards Rule requires that customer information remain available. Retention of seven years or more for returns means archive backups alongside the daily set.
What Downtime Actually Costs a Small Business
Old versions of this backup and disaster recovery guide quoted dramatic statistics about businesses closing after a disaster. The more useful exercise is to calculate your own number. Before you decide what to spend on the options in this backup and disaster recovery guide, take your daily revenue or billings, add the payroll you will pay for a staff that cannot work, add the cost of emergency IT labor and replacement hardware, and add the clients or patients who go elsewhere during a multi-day outage. For a 20-person professional firm, a one-week outage routinely costs more than a decade of a proper backup and disaster recovery subscription.
IBM’s 2026 Cost of a Data Breach research puts the average time to identify and contain a breach at well over 200 days, which is why having clean backups that predate the intrusion, and the retention to reach them, matters as much as the backups themselves.
Backup and Disaster Recovery Mistakes We See in NJ Offices
- A single USB drive plugged into the server, which ransomware encrypts along with everything else.
- Cloud backup credentials stored on the server they protect, so the attacker deletes the backups first.
- Backing up files but not the application or database, so the restore produces data nobody can open.
- No Microsoft 365 backup, and the belief that the recycle bin is one.
- Retention of 30 days when the intrusion happened 90 days ago.
- Backup alerts going to a mailbox nobody reads.
- A recovery plan that lives on the server that just failed.
- Never testing a restore until the day it is needed.
Backup and Disaster Recovery Guide: Frequently Asked Questions
How often should a small business back up its data?
It depends on your RPO and RTO. Critical databases and servers should be backed up at least hourly; files and email at least daily. Modern image-based systems make 15-minute intervals routine, and the cost difference is small.
Is cloud backup enough?
Per this backup and disaster recovery guide, for businesses with no on-premises servers and a relaxed RTO, a cloud backup with immutable retention plus SaaS backup can be enough. Any business with a server, or that cannot be down for more than a few hours, needs local recovery capability as well.
Does Microsoft 365 back up my email?
No, and every backup and disaster recovery guide should say so plainly. Microsoft keeps your data highly available and offers limited retention and recycle-bin recovery, but it is not a backup against deletion, ransomware, or account compromise, and Microsoft’s own terms say so. Use a third-party backup.
What is an immutable backup?
A backup copy that cannot be modified or deleted for a defined period, even by an administrator or an attacker with administrator credentials. In this backup and disaster recovery guide it is the modern replacement for the offline tape in the 3-2-1 rule.
How long should we keep backups?
Long enough to recover from an intrusion that went unnoticed for months, and long enough to meet your industry’s records requirements. Ninety days of frequent restore points plus monthly or yearly archives retained for several years is a common pattern for professional firms.
Put a Tested Backup and Disaster Recovery Plan in Place
Backup and disaster recovery is the one part of IT where you only find out whether it worked when it is too late to fix. eMDTec has designed, run, and tested backup and DR for New Jersey medical practices, law firms, accounting firms, and professional services businesses since 2002, from immutable cloud backup and BCDR appliances to Microsoft 365 backup and the written plan that ties it together, as part of our managed IT services. Schedule a free consultation and we will review what you have today against this backup and disaster recovery guide, including a test restore.