People say "we have backups" and "we have disaster recovery" as if they were the same claim. They answer different questions.
Backup: do we have a copy of the data?
A backup is a stored copy of data, taken at a point in time, that you can go back to. It protects you from deleted files, corrupted data, ransomware and hardware failure, provided the copy is intact and out of reach of whatever caused the problem.
Disaster recovery: how do we get the business running again?
Disaster recovery is the plan, and the capability, to bring systems and services back after a serious disruption such as a failed server, a cloud outage, a fire or a cyber incident. It covers more than data. It includes where systems will run, in what order they come back, who does what, how people reach them in the meantime and how long all of that takes.
You can have good backups and no realistic recovery plan. In that case you own the data, but rebuilding servers, restoring in the right order, re-establishing access and reconnecting users may take far longer than anyone expects.
Two numbers that make the difference concrete
- How much data can we lose? If losing a day of work is unacceptable, a nightly backup is not enough.
- How long can we be without this system? If the answer is "a few hours" but a full rebuild would take days, there is a gap.
Writing these down for each important system turns a vague worry into something you can compare with reality.
What a small business usually needs
Most small businesses do not need an elaborate, always-on second site. They do need to be clear about the following.
- Which systems matter most, and what the business would do without each of them for a day or a week.
- Backups that are complete, tested and protected, including at least one copy that an attacker or a mistake cannot reach.
- A short, written recovery plan for the few systems that matter most: order of recovery, access details, contacts and who decides what.
- A tested restore, even a partial one, so the plan is based on measured times rather than hopes.
More advanced options, such as replicating systems to another location, are worth considering only where the cost of downtime justifies them.
Where to start
If you are unsure which of the two you are missing, begin with the backups: a Backup Health Assessment shows what is covered and whether restores would work. If your concern is the whole recovery picture, a Disaster Recovery Readiness Assessment looks at critical systems, dependencies and the gap between what you need and what you could deliver.
Both are advisory reviews with written findings. Neither guarantees recovery, and any implementation would be scoped and agreed separately.