You Have Backups. Could You Actually Reopen on Monday? Backup vs Business Continuity

A backup is a spare tyre in the boot. Business continuity is whether you can actually get the car moving again on the hard shoulder — with a jack that works, someone who knows how to change it, and a plan for the appointment you're now late for. Most SMEs have the spare and assume that means they can drive; they find out otherwise on the roadside. The difference comes down to two numbers nobody has written down — how much data you can afford to lose (RPO) and how long you can afford to be down (RTO) — and whether anyone has ever actually practised the change.

"We have backups" — the sentence that hides four questions

When an owner says it, it usually means a copy of some data exists somewhere. Continuity asks: Which systems? The file server, yes — but the accounting system, the email, the CRM, the laptops? How old is the copy? If it ran last night, you lose today. How long to bring it back? A full restore of a server can be a day; rebuilding the logins, printers and settings around it can be a week. And has anyone ever done it? A backup you've never restored from is a hope, not a plan. The four answers, written down, are the whole difference between backup and continuity.

The two numbers to agree this week: RPO and RTO

• RPO — how much work you can afford to redo. If backups run nightly, your RPO is 24 hours: a failure at 5pm means re-entering the whole day's orders and invoices. For many SMEs, 1–4 hours on the systems that take orders and money is the realistic target; 24 hours is fine for the archive nobody touches.
• RTO — how long you can afford to be down. The time from "it's dead" to "we're trading". Vendor benchmarks for 10–50-person businesses sit around 4–24 hours for core systems. The honest number comes from your downtime cost: at S$1,700 an hour, a 24-hour RTO is a S$40,000 decision, and a 4-hour one is worth paying for.

Both numbers are business decisions dressed up as technical ones. Your IT provider can hit almost any target — the cost goes up as the numbers go down — so the owner's job is to pick them deliberately, using the napkin math, rather than inherit whatever the backup software defaulted to.

What a continuity-grade setup looks like (in plain terms)

1. 3-2-1, plus one copy nobody can touch. Three copies, two kinds of storage, one off-site — and increasingly one that's immutable or offline, because modern ransomware goes for the backups first. If your only backup is a drive plugged into the same server, you have one copy, not three.
2. Cloud systems too. Microsoft 365 and Google Workspace keep your data available; they don't promise to restore the folder a departing employee deleted three weeks ago. Separate backup of mail and files is a line item, not an assumption.
3. A tested restore every quarter. One file, one folder, one whole system — timed. The most common cause of failed recoveries is a backup everyone assumed was running that had quietly stopped months earlier. The quarterly test is how you find that out on a Tuesday instead of during a crisis.
4. A one-page plan with names. Who declares the incident, who calls the provider, where staff work if the office network is gone, how customers are told, which system comes back first. One page, printed, because the plan stored on the dead server is worth nothing.
5. The people half. Can staff log in from home laptops? Do they know the second phone number for the provider? Continuity fails on humans more often than on hardware.

What it costs a 30-person Singapore company

Plain backup of servers and Microsoft 365 for a 30-person company typically runs in the low hundreds of dollars a month. A continuity-grade setup — immutable copies, a 4-hour RTO, quarterly tested restores and the plan — is more like S$500–1,500 a month depending on how much you run and how fast you need it back, and is often bundled into a managed IT plan. As our price guide put it: "we back up nightly" is cheap; "we can have you trading again in 4 hours" is not — and your downtime number tells you which one you're actually buying.

The ransomware reality check

Average ransomware-related downtime ran around 24 days in 2025 surveys, while only about 16% of businesses recovered within a day. That gap is almost entirely explained by this article: the one-day companies had separated, tested backups and a plan with names on it; the three-week companies had "backups". It's also why Backup and Respond are two of the five areas in the Cyber Essentials mark — the government's view of the baseline is the same as ours.

Frequently asked questions

We're fully on Microsoft 365 — isn't that backed up already?

Microsoft protects against their infrastructure failing, not against your mistakes, your departing staff or a ransomware-encrypted sync. Short retention windows cover accidents from last week, not last quarter. A separate backup of mail and files is standard practice, and cheap.

How often should we test a restore?

Quarterly for a meaningful system, and the result — how long it took — goes in writing. If your provider has never sent you a restore test result, they've never done one for you.

Do we need a full disaster-recovery site?

Almost no SME does. Cloud recovery — bringing a copy of your server up in a data centre within hours — gives most businesses a 4-hour RTO for a fraction of what a standby office used to cost.

Does cyber insurance replace all this?

No — it funds the recovery; it doesn't shorten it. And as we covered in our cyber insurance guide, insurers now require tested backups before they'll cover you at all.

Send this to your IT provider

The owner's job is to set the two numbers and ask for evidence. Everything else is theirs:

Hi — I'd like to agree our recovery targets in writing. For our core systems (please list them), what RPO and RTO do we currently have, and what would it cost to reach [1–4 hours] of data loss and [4–8 hours] to be trading again? Please also confirm: where our backups are stored and whether one copy is immutable or offline; whether Microsoft 365 mail and files are separately backed up; the date and duration of our last tested restore; and whether we have a one-page recovery plan with named contacts. If any of these are "no", give me a cost and timeline.

Our approach

For managed IT clients we agree RPO and RTO in the contract, keep an immutable copy, and send the quarterly restore-test result — time taken, in writing — so "we have backups" means something specific. Want the four questions answered for your setup? Book a discovery call — we'll tell you honestly whether you have a spare tyre or a way home.