Tech IT Out: Backup, DR & BCP Explained

Is Your Backup Strategy Really Protecting Your Business? Backup, DR & BCP Explained

In this episode, we discuss one of the most overlooked yet business-critical areas of IT: Backup, Disaster Recovery and Business Continuity.

Backup is no longer just about recovering lost files. With ransomware attacks on the rise, increasing compliance requirements, and growing reliance on cloud services, organisations need a resilient strategy that enables them to recover quickly and keep the business running when the unexpected happens.

In this episode of Kromecast: Tech IT Out, Sam Mager is joined by Technical Director Ben Randall to explore the practical steps every organisation should be taking to strengthen its backup, disaster recovery and business continuity planning.

In this episode we cover:

• What is the difference between Backup, Disaster Recovery (DR) and Business Continuity Planning (BCP)?
• Why Microsoft 365 alone isn’t a complete backup solution How ransomware is changing modern backup strategies
• The importance of the 3-2-1 backup rule, immutable backups and air-gapped storage
• Understanding Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)
• Best practices for restore testing, documentation and compliance
• Practical advice for building a resilient backup and recovery strategy that keeps your business protected

Whether you’re responsible for IT infrastructure, cybersecurity, compliance, or business resilience, this episode provides practical advice to help you strengthen your backup and recovery strategy and ensure your organisation is prepared for whatever comes next..

This episode covers some of these key Backup, DR and Business Continuity Questions:

What is the difference between backup, disaster recovery and business continuity?

Backup, disaster recovery and business continuity are closely connected, but they serve different purposes. Backup focuses on creating recoverable copies of your data. Disaster recovery goes a step further, considering how you restore the systems, servers and infrastructure that data relies on following a major incident. Business continuity looks at the wider organisation and how critical operations can continue during disruption, including where employees will work and how essential services will remain available.

A backup alone is not a disaster recovery or business continuity plan. All three need to work together as part of a wider resilience strategy.

What is the difference between RTO and RPO?

Recovery Time Objective (RTO) defines how quickly a system or service needs to be restored following an incident. Recovery Point Objective (RPO) defines how much data an organisation can afford to lose.

For example, a business-critical system may need to be restored within four hours, giving it an RTO of four hours. If the business can only afford to lose one hour of data, backups or replication must be frequent enough to meet a one-hour RPO.

Not every system needs the same RTO or RPO. Organisations should identify and tier critical applications and data based on their importance to business operations.

Does Microsoft 365 include backup?

Microsoft protects and maintains the Microsoft 365 platform, but organisations should not assume this provides a complete backup and recovery solution for their individual business data.

If data is accidentally deleted, deliberately removed or compromised, organisations still need a way to recover that information. Simply storing data within a SaaS platform such as Microsoft 365 does not remove the need for a clearly defined backup and recovery strategy.

Do I need a third-party backup for Microsoft 365?

Organisations should consider a dedicated Microsoft 365 backup solution to ensure business data can be recovered following accidental deletion, malicious activity or a cyber incident.

The important question is not simply whether your data is stored in Microsoft 365, but whether you can restore the data you need, from the point in time you need it, within an acceptable timeframe. A dedicated backup solution provides greater control over retention and recovery and should form part of your wider resilience strategy.

How often should disaster recovery be tested?

Disaster recovery and restore processes should be tested at least annually, with the results documented and the recovery plan reviewed as part of the exercise.

Testing should ideally be carried out by someone other than the person who originally wrote the recovery documentation. This helps identify missing steps or assumptions that may only be obvious to the plan’s author.

Organisations should also review their disaster recovery documentation regularly. Technology, infrastructure and business requirements change quickly, and a plan written twelve months ago may no longer accurately reflect the current environment.

What is an immutable backup?

An immutable backup is a protected copy of data that cannot be altered, encrypted or deleted during a defined retention period.

This is particularly important when protecting against ransomware. Modern ransomware can remain dormant within an environment and attempt to corrupt or delete accessible backups before targeting production data. Maintaining an immutable, off-site copy helps ensure there is a protected recovery point available if primary systems and other backup copies are compromised.

Immutable backups can also support the 3-2-1 backup principle: maintaining three copies of your data, across two different types of media, with at least one copy stored off-site.

How often should backup restores be tested?

A backup is only valuable if you know you can restore it. Backup restores should be tested at least once a year, although more frequent testing is recommended for business-critical systems and data.

Taking a successful backup does not guarantee that data can be restored when it is needed. Regular restore testing helps confirm that backups are usable, recovery processes work as expected, and documented procedures remain accurate.

For critical systems, organisations should consider scheduling more frequent restore tests based on their recovery objectives, the importance of the data, and how often the underlying environment changes.

Krome Cast Tech IT Out Podcast

If you’re navigating through the challenges of digital transformation, trying to build and maintain a stable and future-proof infrastructure that meets the needs of your business, or you just want to keep up to date with the industry challenges and trends, please head over to our YouTube Channel and hit subscribe!

Our podcast series features in-depth discussions. We cover a range of subjects including technology updates, tech challenges, trends and industry changes. Insights and best practices for IT leaders. Krome’s experience with client projects. How to overcome technical challenges. Considerations to make when embarking on specific upgrades, migrations, and installations. How-to guides and more!

Some of our technology podcasts are also available in audio-only format on all of the major podcast platforms, including Apple, Spotify, and Google Podcasts. It is also available with full video content on our YouTube Channel.

To view some of our other podcasts, please see some suggested episodes below.

• 802.1X Explained – WiFi Pen Testing
• IT Governance & Regulatory Compliance
• Understanding Microsoft Secure Score
• Microsoft Intune Device Management
• Microsoft Copilot Use Cases
• Microsoft Defender for Endpoint Demo
• Microsoft Copilot Security & Compliance Risks
• Microsoft Purview Data Security and Compliance with M365