Backup and disaster recovery: the minimum plan

No one thinks about backups until they need one. And when they do — a ransomware attack, a failure, a human error that deletes the wrong folder — discovering that you don’t have a working one is one of the most costly situations a business can find itself in. Backup is not an IT matter to delegate and forget: it is business continuity. Let’s look at the minimum plan that every SME should have.

Backup and disaster recovery are not the same thing

Two concepts often confused.

• A backup is a copy of the data that lets you recover it if the original is lost.
• Disaster recovery is the plan that lets you get back up and running after a serious incident: not just the data, but the systems, the access, the processes.

Having backups but no recovery plan is like having the bricks but no blueprint to rebuild the house. You need both.

The 3-2-1 rule

It is the benchmark standard, simple and time-tested:

• 3 copies of the data (the original plus two backups).
• 2 different media (for example a local disk and the cloud).
• 1 off-site copy, physically separate, ideally not always connected.

The separate, offline copy is the decisive defence against ransomware: an attack that encrypts the connected systems cannot touch a backup that is not reachable over the network. Many companies discover too late that their backups were on the very system that was hit.

The two questions that define the plan: RPO and RTO

Before choosing the tools, answer two business questions.

• RPO (Recovery Point Objective): how much data can you afford to lose? If you back up once a day, a failure could cost you up to a day’s work. For invoicing or orders that may be unacceptable: you need a higher frequency.
• RTO (Recovery Time Objective): how long can you afford to be down? An hour, a day, a week? The answer determines how quick the recovery must be.

There is no universally correct answer: it depends on how much an hour of downtime costs your business. But the question must be asked beforehand, not during the emergency.

A backup that has never been tested does not exist

It is the most widespread and most serious mistake. A backup that runs every night gives a false sense of security until you try to restore it — and discover it was incomplete, corrupted, or that no one knows how to do it. A backup is only worth as much as the restore you get from it.

The minimum rules:

1. Test the restore periodically, not just the running of the backup.
2. Document the procedure: who does what, with which access, in what order.
3. Check the alerts: if a backup fails, someone must notice straight away.

The human factor and ransomware

Most incidents do not arise from hardware failures but from human error and attacks. The technical plan must be accompanied by simple measures: constant system updates, multi-factor authentication on critical access points, training people to recognise phishing e-mails. The offline copy, as mentioned, is the last line of defence when everything else has been compromised.

Data protection and retention

The subject also touches the legal side, not only the technical one.

• Swiss law provides for the obligation to retain commercial and accounting documents for ten years. Your backup system must ensure that these documents remain recoverable and readable for the entire period.
• The new Data Protection Act (nFADP) requires adequate security measures for personal data: an unprotected backup, or one kept without a clear approach, is itself a risk.
• If the backups are in the cloud, check where they are kept and with what guarantees, favouring hosting in Switzerland or the EU with clear terms.

The minimum plan, in summary

Even a small SME can give itself a solid foundation: apply the 3-2-1 rule, define RPO and RTO based on what downtime costs you, keep an offline copy against ransomware, test the restore at regular intervals, document who does what in the event of an incident and make sure you meet the ten-year retention obligations. You don’t need complex infrastructure: you need a written, tested plan.

How we work

SIH ONE is an AI-native fiduciary group: we combine technological expertise with knowledge of Swiss data retention and protection obligations. We help you set up a backup and continuity plan scaled to your business, one that holds together technical security, realistic recovery times and regulatory compliance.

Do you want to be sure you can start over after an incident? Let’s talk about it.