Beyond Backup: A Disaster Recovery Plan for Your Small Business

Most small businesses we meet have backups. Far fewer have a disaster recovery plan, and the difference shows on the worst morning of the year. A backup is a copy of your data. A disaster recovery plan for your small business is the documented, tested answer to harder questions: when the server dies, the ransom note appears, or the office floods, who does what, in which order, and how long until your team can work again?

That gap is where companies lose real money. Based on field observations, the businesses that recover fastest are rarely the ones with the priciest tools. They decided in advance what matters most, wrote it down, and rehearsed it. This guide covers the 3-2-1-1-0 backup rule, RTO and RPO in business terms, restore testing, roles and the contact tree, and where SaaS backup like Dropsuite fits.

Key Takeaways

• A disaster recovery plan documents who does what and how fast, not just where backups live.
• The 3-2-1-1-0 rule: three copies, two media types, one offsite, one offline or immutable, zero errors.
• RTO is how long you can afford to be down. RPO is how much data you can afford to lose.
• Untested backups are assumptions. Test small restores monthly and rehearse a full recovery yearly.
• Microsoft 365 data needs its own backup. Native retention settings are not a recovery plan.

Why Your Small Business Needs a Disaster Recovery Plan

Backups answer one question: do we have a copy? Recovery raises all the others. Which system comes back first? Who can authorize emergency spending? What do you tell clients on day one?

A working plan for an SMB fits in five to ten pages and needs six elements:

• An inventory of systems, ranked by how quickly the business hurts without them
• RTO and RPO targets per tier, approved by ownership, not just IT
• Step-by-step restore procedures for your specific tools
• Named roles with alternates, plus a contact tree
• A communication plan for staff, clients, and regulators
• A testing schedule with dates and owners

For Quebec businesses, Law 25 adds weight here: an incident touching personal information triggers notification duties, and a plan that covers that step keeps you from improvising at midnight.

The 3-2-1-1-0 Backup Rule, Explained

From 3-2-1 to 3-2-1-1-0

The classic 3-2-1 backup rule says keep three copies of your data, on two types of media, with one copy offsite. It's still the right foundation, but ransomware changed the math: attackers hunt for backups first and encrypt or delete them before triggering the main event. The modern version adds two digits:

• 3 copies of your data (production plus two backups)
• 2 different media or platforms (a local appliance and cloud storage, for example)
• 1 copy offsite (cloud backup, or a drive stored elsewhere)
• 1 copy offline or immutable, so nobody can alter or delete it, not even an admin account
• 0 errors, verified: jobs are monitored, alerts get read, and test restores confirm the copies open

For a typical SMB: production on the server, a local appliance for fast restores, cloud backup offsite with immutability enabled, and a daily check of job results. If you're unsure which digit you're missing, it's almost always one of the last two.

RTO and RPO Explained in Business Terms

Two acronyms carry most of the weight in any disaster recovery plan:

• RTO (Recovery Time Objective): how long the business can tolerate a system being down, from "we declare a problem" to "people are working again."
• RPO (Recovery Point Objective): how much data you can afford to lose, measured in time. If your last usable backup ran at 11 p.m. and the failure hits at 3 p.m., you've lost 16 hours.

Neither is a technical setting. Both are business decisions that determine which tools you need.

A Worked Example: An Accounting Firm Loses Its File Server

Picture a 20-person accounting firm. On a Tuesday in April, mid tax season, the file server's storage controller fails at 9 a.m. and corrupts the volume. Client files, working papers, and templates all live there. The firm backs up nightly at 11 p.m. to cloud storage.

• The RPO reality: the last good copy is from 11 p.m. yesterday. Everything saved since then must be redone. At 9 a.m. that's painful but survivable. Had the failure hit at 4 p.m., the firm would lose a full day of work by 20 people at the busiest time of year.
• The RTO reality: recovery means sourcing hardware, rebuilding the server, then pulling roughly 2 TB back from the cloud. On a 100 Mbps connection, 2 TB is about two days of continuous transfer. Add rebuild time and the realistic outage is three to four days.

Now put hypothetical numbers on it. Suppose each of the 20 employees produces $100 an hour in billable work. Three idle days is roughly $48,000 in lost capacity, before missed filing deadlines and overtime.

Compare that to the fix. A local appliance that can boot the file server as a temporary virtual machine cuts the RTO from days to under an hour. Hourly snapshots cut the RPO from up to 24 hours to one hour. Those options cost money, which is exactly why RTO and RPO should be set by owners looking at numbers like these, not defaulted by whoever installed the backup software.

Most SMBs land on tiers:

• Tier 1 (file server, line-of-business apps): RTO 4 hours, RPO 1 hour
• Tier 2 (email and collaboration in Microsoft 365): RTO 8 hours, RPO 24 hours
• Tier 3 (archives, reference data): RTO a few days, RPO 24 hours

Where SaaS Backup Fits: Microsoft 365 and Dropsuite

A common blind spot: the plan covers the server in the closet but not the data in Microsoft 365. Microsoft keeps the service running; protecting your data against deletion, ransomware syncing through OneDrive, or a compromised account is your responsibility. Retention policies and recycle bins aren't an independent copy that survives an attacker with admin rights.

That's why SaaS backup gets its own line in the plan. A tool like Dropsuite takes independent, point-in-time copies of Exchange, SharePoint, OneDrive, and Teams, stored outside your tenant, which also satisfies the offsite digit of 3-2-1-1-0 for your cloud data. We compared the options in our Microsoft 365 Backup vs Dropsuite breakdown, and our backup and recovery service bundles the licensing, monitoring, and restore testing.

Restore Testing: The Schedule That Keeps Backups Honest

A backup that has never been restored is an assumption, not a safeguard. Jobs fail quietly: agents stop, credentials expire, a folder gets excluded during a cleanup. The fix is boring and effective: put restore tests on the calendar and log the results.

• Daily: automated job verification, with a human reading the alerts (the "0" in 3-2-1-1-0)
• Monthly: restore one random file and one mailbox item; note how long each took
• Quarterly: restore a full server or VM into an isolated environment and measure against your RTO
• Annually: rehearse a complete recovery of Tier 1 systems and have staff actually use the restored copies

Every test either builds confidence or surfaces a gap while it's cheap to fix. If nobody on your team has time to own this, it's a standard deliverable of a managed IT agreement.

Roles, Contact Tree, and Tabletop Exercises

Tools don't run recoveries; people do, usually stressed and sometimes at 3 a.m. Your plan should name:

• An incident lead who declares the disaster, sets priorities, and authorizes spending
• A technical lead who executes the restore, internal or your MSP
• A communications owner who keeps staff, clients, your insurer, and if personal data is involved, the regulator informed
• Alternates for each role, because disasters don't check vacation calendars

Print the contact tree and keep copies at home and offsite: MSP emergency line, internet provider, insurer, key vendors, after-hours numbers. A contact list stored only on the server it's meant to rescue is a joke that writes itself.

Then rehearse with tabletop exercises. Twice a year, for 90 minutes, walk through a scenario: it's 7 a.m. on a Friday and there's a ransom note on every screen. Nobody touches production; you talk through decisions in order. Who confirms it's real? Do we cut the network? Who calls the insurer? Tabletops cost nothing and reliably surface expired contacts, unclear authority, and missing passwords. If detection worries you, our writeup on running an SMB SOC with Sentinel and Defender for Business covers spotting the attack early.

FAQ

What's the difference between a backup and a disaster recovery plan?

A backup is a copy of your data. A disaster recovery plan is the documented process for using those copies to get the business running again: priorities, recovery targets, procedures, and named people. Backups without a plan usually produce slow, improvised recoveries.

Is the 3-2-1 backup rule still enough in 2026?

The foundation holds: three copies, two media types, one offsite. But ransomware operators target backups deliberately, so extend it to 3-2-1-1-0 with one offline or immutable copy and daily verification for zero errors. The immutable copy is the one an attacker with stolen admin credentials can't touch.

What are reasonable RTO and RPO targets for a small business?

There's no universal number; it depends on what downtime costs you. A common SMB pattern is an RTO of 4 hours and an RPO of 1 hour for critical systems, with nightly protection for the rest. Work it out by asking what an hour of downtime would cost during your busiest week.

How often should we test our backups?

Verify job results daily, restore a sample file monthly, restore a full system quarterly, and rehearse a complete recovery once a year. Log every test with the date and duration. Untested backups tend to fail at the worst moment because that's the only time anyone tries them.

Do I really need to back up Microsoft 365?

Yes. Microsoft protects the service infrastructure, but deletions, sync-based ransomware, and account compromise are your responsibility. Retention settings aren't independent copies held outside the tenant. A dedicated SaaS backup tool such as Dropsuite closes that gap with point-in-time restores.

A disaster recovery plan for a 20-person business doesn't need to be a binder; a tested ten-page document beats an untested hundred-page one every time. If you'd like a second set of eyes on your recovery posture, our free IT assessment includes exactly that, and we'll tell you plainly which digit of 3-2-1-1-0 you're missing.