It’s a question worth sitting with properly rather than skimming past: if your business lost access to its systems tomorrow, whether from a ransomware attack, a hardware failure, or simply someone accidentally deleting the wrong folder, how long could you keep operating, and how quickly could you get back to normal?
For Week Four of our Cyber Security Awareness Month series, we’re moving from prevention to resilience. Every habit covered so far, phishing awareness, MFA, patching, reduces the chance of something going wrong. This week is about what happens if, despite all of that, something still does.
Backup and disaster recovery aren’t the same thing
A backup is a copy of your data. A disaster recovery plan is the documented process for what happens next: who does what, in what order, and how quickly the business can get back to functioning, not just how quickly a file can be restored. Many businesses have the first without the second, which means data may technically be safe while the business itself still grinds to a halt for days working out how to actually use it.
The 3-2-1 rule, simply explained
A well-known and still reliable standard for backups is to keep 3 copies of your data, on 2 different types of storage, with 1 copy stored off-site or in the cloud. The logic is straightforward: if a single copy, single location, or single storage type fails or is compromised, at least one of the others survives. A backup stored only on the same network as the systems it’s protecting can be encrypted or destroyed alongside them in a ransomware attack, which defeats the point of having it.
A plan is only as good as its last test
It’s easy to assume a disaster recovery plan will work because it looks complete on paper. The only way to actually know is to test it, on a regular basis, not just once when it’s first written. Testing tends to surface the details that get missed in planning: a step that assumes someone specific is available, a backup that restores more slowly than expected, or a system dependency nobody had accounted for. Regular testing also matters practically: it’s increasingly something insurers ask for evidence of as part of cyber insurance policy conditions.
The real cost of getting this wrong
The disruption caused by a lost-access event tends to compound the longer it lasts: lost revenue while systems are down, reputational damage if customers are affected, and potentially regulatory consequences depending on what data was involved. A plan that gets the business operational again in hours rather than days or weeks makes a material difference to how much of that impact actually lands.
Three practical steps this week
- Check where your backups actually live. If every copy is reachable from the same network as your live systems, that’s a gap worth closing.
2. Ask when your disaster recovery plan was last tested, not just written or reviewed on paper.
3. Confirm who’s responsible for what in the first hour of an incident. A plan without clear ownership causes delay exactly when speed matters most.
How Information Solutions can help
As your IT support partner, we’re well placed to help build a disaster recovery plan that reflects your actual infrastructure and business priorities, not a generic template, and to run controlled testing with full reporting you can keep on file, including for insurance purposes. If it’s been a while since your plan was reviewed, or you don’t have one in place yet, get in touch and we can talk through what’s needed.