Backup and Disaster Recovery
NEVER LOSE A DAY OF WORK

A backup is a copy of your data. A disaster recovery plan is the instructions for turning that copy back into a working business. Most companies have the first and not the second, which is why a bad morning turns into a bad week: the data is there, but nobody has agreed what comes back first, who authorises it, or where people work in the meantime. Business continuity is the wider question of how you keep trading while that happens.

You restore from it and time how long it took. There is no other way to know. As our Director of Operations puts it, backups are not a one-and-done thing: it is a journey, not a destination. A restore test usually needs a maintenance window and somebody's afternoon, so it is normally scoped and quoted as its own piece of work rather than something that quietly happens in the background. We would rather tell you that than let you assume.

Peter Swarowski, Director of Operations, ITS. [VERIFY BEFORE PUBLISH: ITS's published position in 2022 was that restore testing is a billed project. If testing is now bundled into a plan, this answer must say so instead. Do not ship either version unconfirmed.]

Those are the two numbers the whole design hangs on, and they are yours rather than ours. The first is how much recent work you could stand to re-enter, which sets how often copies are taken. The second is how long you could stand to be down, which sets what we restore onto and in what order. Both get agreed with you and written into the plan. Any provider quoting you those figures before asking about your business is quoting you a product, not a plan.

Longer than most people guess, and not forever. Two things set it. The first is regulation: HIPAA, for example, requires that records relevant to it are kept for six years from the date they were last used or last in effect. The second is how far back a problem can hide, because a corrupted file or a quiet deletion is often noticed weeks later. Keeping everything forever is expensive and increases what a breach can expose, so retention is a decision, not a default.

Source for the six years: HIPAA documentation retention requirement, as published at itsasap.com/blog/how-long-data-retention.

HIPAA does not certify backup products, so no honest provider will tell you their software is HIPAA compliant. What the rule actually asks for is a retrievable exact copy of electronic protected health information, a procedure for restoring it, and documentation you can show a reviewer. That is a design question and a paperwork question rather than a shopping question. We wrote up what the requirements actually say, and if healthcare is your reason for being on this page, start there.

[VERIFY the linked article's characterisation of the requirement before publish. This answer paraphrases the rule's intent rather than quoting a citation on purpose.]

BDR stands for backup and disaster recovery, and in practice it usually means a device that sits on your network holding copies and, if a server dies, standing a temporary one back up from them so people can keep working. It is the difference between having your data and having your business. You do not always need one: it depends on whether you still run servers on site and how long you could work without them. Ransomware recovery is a related but separate question, and it has its own page.