A backup is a recoverable copy of data. Disaster recovery is the people, priorities, technology and tested procedure used to restore an acceptable business service after serious disruption. Most businesses need both: backups supply recovery material, while the disaster-recovery plan decides what returns first, where it runs and who authorises the work.

Reviewed: 9 September 2026

Backup and disaster recovery compared

Question	Backup	Disaster recovery
Primary purpose	Recover data or configuration	Restore an operating service
Main design input	Data, change rate and retention	Business impact and dependencies
Typical evidence	Job result and restore test	Timed recovery exercise
Includes people and decisions?	Usually limited	Yes
Handles an unavailable site?	Not by itself	It should address the scenario

What a backup protects

A backup can protect files, databases, virtual machines, application configuration, cloud data and network-device settings. The design should identify what is included, how frequently it is copied, how long versions remain, where copies are stored, who can access them and how failures are handled.

Snapshots, replication and synchronisation can support recovery but are not automatically independent backups. A deletion, encryption event or administrator mistake may replicate to another location. Understand the failure boundary of each copy.

What disaster recovery adds

Disaster recovery considers the complete service: infrastructure, identity, connectivity, applications, data, suppliers, workplaces, people and communications. It defines the minimum viable service, recovery order, technical procedure, decision authority and criteria for returning to normal operation.

A plan should cover credible scenarios such as loss of a server, cloud account, office, internet connection, key supplier or privileged access—not only a generic “disaster”.

Set RPO and RTO from business impact

Recovery point objective (RPO) describes the maximum tolerable period of data loss. Recovery time objective (RTO) describes the target time for restoring an acceptable service. They are business requirements that shape technology and cost, not numbers selected by a backup product.

A four-hour RPO may require data to be protected more often than once per day. A four-hour RTO may require pre-built capacity, working credentials and rehearsed procedures rather than waiting for hardware, licences and specialists after an incident.

Use ACA’s recovery priority planner to rank systems from business impact, dependencies, RTO and RPO.

Make backup copies independent

Keep copies across failure boundaries appropriate to the risk. This may include a separate account, provider, region, physical location or offline/immutable tier. Restrict deletion and configuration rights, protect administrators with strong authentication and alert on changes to backup policies or retention.

Encryption protects backup confidentiality, but keys and recovery credentials must remain available during an incident. Store the recovery route so an authorised person can reach it if normal identity, email or premises are unavailable.

Protect the whole application, not only its files

Document databases, file storage, secrets, certificates, queues, DNS, identity, licences and third-party integrations. Use application-consistent methods where required and record the correct recovery sequence. Restoring a database from one moment and uploaded files from another can create inconsistency.

Test a restore, then test the service

A restore test answers whether selected data can be recovered. A disaster-recovery exercise answers whether the business service can return within its objectives. Run both.

Restore representative files and databases to an isolated location.
Measure the time from decision to usable service.
Validate permissions, application behaviour and integrations.
Record missing knowledge, credentials and dependencies.
Assign owners and dates to improvements.

The NCSC’s MSP guidance advises customers to agree backup arrangements, storage, access and testing with their provider and to consider how both service and data would recover from ransomware.

Choose a recovery model that matches the service

Backup and rebuild

Suitable where longer interruption is tolerable and infrastructure can be recreated reliably. It has lower standby cost but demands complete documentation, available installers and tested configuration recovery.

Warm standby

Core components exist in another environment but need scaling, data recovery or activation. This can balance cost and recovery speed if the activation procedure is rehearsed.

Active or near-active recovery

Multiple environments carry live or rapidly recoverable service. It may reduce interruption but adds architecture, consistency, monitoring and testing complexity. Replication errors can affect both sides.

Include suppliers and communications

Record hosting, telecoms, software, payment and support contacts, account identifiers and escalation paths. Decide who communicates with staff, customers, insurers, advisers and authorities where required. Keep a short contact and decision card outside normal systems.

ACA’s incident response card builder helps prepare the first actions and contacts without pretending to replace a full plan.

How much backup storage do you need?

Capacity depends on source data, daily change, retention tiers, full backup seeds, compression, immutability and independent copies. Do not multiply current data by the number of days unless that matches the real backup method. Model growth and repository overhead, then watch actual consumption.

Use the backup storage estimator for a transparent planning model and validate it against the chosen platform.

A practical decision sequence

Identify business services and maximum tolerable disruption.
Set justified RTO and RPO targets.
Map data, identity, infrastructure and supplier dependencies.
Design protected, independent backup copies.
Select a recovery architecture that can meet the targets.
Write roles, decisions and communication routes.
Test, measure and improve.

ACA’s managed server service can include backup configuration, monitoring and recovery work within a clearly agreed scope.

Frequently asked questions

Is cloud storage a backup?

It can form part of one, but synchronisation and platform recovery features may not meet every retention, independence or restore requirement. Verify the failure scenarios covered.

Does a successful backup mean recovery will work?

No. Test representative restores and then test the complete service and decision process.

Do small businesses need disaster recovery?

Any business that depends on technology needs a proportionate recovery plan. It may be short and simple, but it should still name priorities, owners, dependencies and tested actions.