Finding the Right Disaster Recovery Strategy for SMBs

So, what’s the right approach? Is it Disaster Recovery as a Service (DRaaS)? Should SMBs consider immutable backups and hybrid cloud models? Let’s explore how SMBs can find an appropriate balance of affordability, resilience and complexity as they build recovery plans that can keep operations running through unexpected disruptions.

How SMBs Can Rethink Their Approach to Disaster Recovery 

Simply asking whether or not your business has a backup solution is old-school thinking that needs to be retired. Chris Bevil, principal for global cyber resilience and artificial intelligence at Commvault, suggests reframing the question as, “Can I recover the parts of my business that matter most, quickly and safely?” 

“That shift matters,” Bevil says. “Backup is just the starting point. Recoverability is what actually determines whether a business survives an incident.” 

READ MORE: Microsoft 365 Business Premium boosts SMB security With Defender and Purview. 

SMBs can start by identifying their most critical systems, such as payroll, billing, customer data or email, Bevil notes, and define how long they can afford to be down and how much data they can afford to lose. “At the end of the day, having a copy of your data doesn’t help if you can’t cleanly restore it when it counts,” he adds. 

Is Disaster Recovery as a Service a Good Fit? 

Vanover says there are solutions that are tailored to the needs of SMBs, incorporating automation and managed recovery at a lower cost. A skills gap can be an issue among the smaller IT teams SMBs may have, so relying on an on-demand service for disaster recovery may make more sense. 

Bevil adds that SMBs should evaluate a solution as “part of a broader business continuity strategy, not just another cloud service.” He suggests these practical questions: 

1. What systems need to recover first? 
2. How fast do they need to come back? 
3. Who actually declares a disaster? 
4. Who is responsible for failover and failback? 
5. How often is recovery tested and proven? 
6. What costs show up during a real recovery event? 

“DRaaS tends to make the most sense when a business needs predictable, repeatable recovery but lacks the internal resources to build and maintain that capability itself. The simplest way to look at it: If you can’t confidently ensure recovery in-house, DRaaS should absolutely be on the table,” Bevil says. 

The Role of Immutable Backups for SMBs 

In this era, immutable backups are a must-have for businesses, Vanover says. If a business doesn’t have one or more copies of its backup data that is immutable, that should be considered an emergency for its environment. In ransomware cases, where malicious actors can target backup data, having immutable storage is one of the most effective ways to support recovery.

Click the banner below to find out how one small business improved its security.

Vanover says that the most ideal “ultraresilient storage” has one or more of these characteristics: It’s offline, air-gapped, immutable or it requires at least two-person authorization. He also highlights the 3-2-1 backup rule: three (or more) copies of data on two different media, one of which is offsite. 

DISCOVER: Why 'good enough' doesn't cut it for SMB network security. 

Bevil agrees that immutable backups are becoming a baseline requirement for SMBs, but they’re not something that can just be turned on and forgotten. SMBs should follow these guidelines: 

• Set the right retention windows 
• Lock down access controls 
• Enforce multifactor authentication 
• Regularly test restores 

“Immutability isn’t a silver bullet. It won’t stop ransomware from getting in. But it significantly improves your ability to recover without paying an attacker. That’s the difference that matters,” Bevil says. 

Prioritizing Backup and Recovery Amid Tight Budgets 

People are as integral to disaster recovery as technology and processes. So, Vanover says, SMBs should consider cross-training their staff so that expertise and responsibility don’t fall to just one person on the team. If that expert is on vacation when downtime happens, there should be someone else who is trained and can step in. That could be a partner on retainer, he adds. 

Bevil notes that SMBs should not protect their entire environment at the same level because that can lead to overspending in some areas while underprotecting the most critical systems. 

“The businesses that recover best aren’t always the ones with the biggest budgets. They’re the ones that understand what matters most and have proved that they can get it back,” Bevil says.