What It Actually Means
Backups are one component. Disaster recovery is the whole sequence, including who decides, who acts, what order things come back in, and what the business does meanwhile.
The Two Numbers
Everything else follows from these, and they are business decisions rather than technical ones. They belong to you, not to a supplier.
How long can you be down? Recovery time. Answer honestly rather than aspirationally. For plenty of businesses a day is survivable and expensive. For some, two hours is a serious problem. For a few, minutes matter.
How much data can you afford to lose? Recovery point. If backups run nightly and the failure happens at 4pm, you have lost the day. That is fine for some operations and unacceptable for anything taking payments.
Cost tracks these two numbers steeply. Restoring within a day from nightly backups is inexpensive and covers most businesses well. Continuous replication with minutes of loss is a different order of spend. Naming the numbers first means you buy what the business needs instead of what sounds prudent, which is where most of the overspending in this area comes from.
What Gets Forgotten
Plans concentrate on the database and then fail on everything around it.
Access. The recovery guide is in the system that is down, or the person with the credentials is unreachable, or 2FA is tied to a phone nobody can find. Store what is needed to recover somewhere that does not depend on what you are recovering.
DNS and domains. Frequently held in an account nobody has touched in years, controlled by an email address belonging to a former employee. It is a small detail until it is the only thing standing between you and being back.
Third parties. Payment providers, mail services and integrations all need reconnecting, and some hold their own configuration you cannot restore from your backup.
Telling people. Customers, staff and suppliers all need to hear something, and the channel used is often the one that is down.
What To Ask
- What are our two numbers, and does what we pay for match them? Mismatch in either direction is expensive.
- Who declares an incident? Someone must have authority to start a recovery, including out of hours.
- Have we rehearsed it? A plan that has never been run is a document, not a capability.
- What comes back first? Not everything at once. The order should reflect what the business needs to trade, not what is easiest to restore.
The Realistic Version
Most businesses of moderate size need something considerably simpler than the industry sells: verified backups with a tested restore, credentials and instructions held outside the systems they protect, one named person who can decide, and a rough order of what comes back.
Written down, on one page, reviewed once a year. That covers the overwhelming majority of real incidents, and it is achievable in an afternoon rather than as a project. The elaborate version is worth buying only once the two numbers genuinely demand it.
More terms are in the glossary.
