Backup, Disaster Recovery & Business Continuity

How It Works & Technology Overview

Backup copies data so it can be restored; disaster recovery (DR) restores whole systems so the business can run again; business continuity (BC) is the plan for operating while that happens. The scoping currency is two numbers agreed with the business, not the technology: RPO (recovery point objective — how much recent data the business can afford to lose) and RTO (recovery time objective — how long it can be down). Everything else follows from them: snapshot frequency, where copies live, how fast restores must be, and whether systems need to boot somewhere else.

The baseline pattern is 3-2-1: three copies of the data, on two kinds of media, with one copy offsite. Ransomware added a requirement — at least one copy that cannot be altered or deleted (immutable or air-gapped) — and the discipline of verifying that restores actually work.

Common Deployment Scenarios

• Image-based server backup to a local appliance or backup server, replicated to the cloud, with the ability to boot a failed server as a VM on the appliance or in the vendor's cloud.
• Microsoft 365 / SaaS backup: a separate service backing up Exchange Online, OneDrive, SharePoint and Teams. Microsoft's shared-responsibility model leaves data protection to the customer; recycle-bin retention is time-limited (deleted items are gone after at most 93 days) and replicates deletions and encryption.
• Endpoint backup for laptops holding work that never reaches a server.
• DR planning and testing: documented runbooks, test restores, and periodic failover exercises.
• Compliance-driven retention: long-term retention for regulated records or insurer requirements.

Products, Vendors & Characteristics

• Server/VM backup: Veeam, Datto (Kaseya), Axcient, N-able Cove, Acronis, Rubrik and Cohesity in the larger tier; many offer appliance-based local recovery plus cloud replication.
• Microsoft 365 backup: dedicated SaaS backup products from most of the vendors above, plus Microsoft's own Microsoft 365 Backup service.
• Immutability: object-lock storage, hardened Linux repositories, vendor clouds with deletion protection, or offline media.
• Pricing models range from per-device or per-workload to per-terabyte of protected or retained data; long retention changes cost more than device count.

What Makes It Hard (Gotchas & Failure Modes)

• Untested backups: jobs report success while restores fail — missing application consistency, corrupted chains, or credentials nobody kept.
• RTO fantasy: a business that says "zero downtime" but funds a nightly backup to a single appliance. The numbers must be agreed and funded together.
• Bandwidth: the first full upload to the cloud can take days or weeks on a small office connection; seeding by shipped drive is sometimes required.
• Shared credentials: backups reachable with the same admin account that ransomware steals are not protection.
• SaaS blind spots: assuming Microsoft 365 retention is backup; missing Teams channels, shared mailboxes or SharePoint sites.
• Insurance requirements: cyber insurers increasingly ask for offsite, immutable backups and multi-factor authentication on backup consoles — and deny claims when the questionnaire was answered optimistically.
• Restore ordering: domain controllers, databases and applications must come back in the right sequence; nobody knows it until a runbook exists.

Effort & Estimation Patterns

• Backup platform deployment: 4–8 hours per site for the appliance or backup server, storage, retention policy and cloud replication setup, plus 30–60 minutes per protected server for agents, job configuration and first-backup verification.
• Microsoft 365 backup: 2–4 hours per tenant to connect, scope mailboxes, sites and Teams, and verify a test restore.
• RTO/RPO workshop with the business: 2–4 hours, and nothing gets designed before it.
• DR runbook for a small environment: 8–16 hours to document restore order, credentials, contacts and decision points.
• DR test: 1–2 days for a tabletop plus a real restore or failover exercise, typically annually; test restores quarterly.
• Recurring validation: 1–2 hours per month per client to review job health, run spot restores and document results.