CONSULT CIRCLE | BUSINESS CONTINUITY
Backup and disaster recovery solve different problems. Confusing them is why organisations discover their recovery time is measured in days.
Almost every organisation has backup. Far fewer have disaster recovery, and a surprising number believe those are the same thing. They are not, and the difference only becomes apparent at the worst possible moment.
Backup answers: can we get the data back? Disaster recovery answers: how quickly can the business operate again? An organisation with excellent backups and no disaster recovery plan can lose a week restoring systems in an order nobody agreed in advance.
The two metrics that decide everything
| Metric | What it means | What it drives |
|---|---|---|
| Recovery Point Objective (RPO) | How much data you can afford to lose, measured in time | Backup or replication frequency |
| Recovery Time Objective (RTO) | How long you can afford to be down before operations resume | The recovery method and therefore most of the cost |
Table 1 — RPO and RTO.
Set these per system, not for the whole organisation. A finance system and an internal wiki do not warrant the same investment, and treating them identically means either overspending on one or under-protecting the other. Our glossary of disaster recovery terms to know covers the vocabulary in full.
How the options compare
| Traditional backup | Backup with replication | DRaaS | |
|---|---|---|---|
| What it does | Copies data for later restore | Copies data and maintains a secondary copy of systems | Maintains a standby environment ready to run |
| Typical RPO | Hours to a day | Minutes to hours | Seconds to minutes |
| Typical RTO | Hours to days | Hours | Minutes to hours |
| Recovers to | Whatever infrastructure you can find | Your secondary site | Provider infrastructure |
| Requires | Storage and a restore target | A second site and capacity | A service contract |
| Cost profile | Lowest | High capital, idle most of the time | Ongoing subscription |
| Testing | Restore tests | Failover tests, disruptive to arrange | Usually non-disruptive testing included |
Table 2 — Backup, replication and DRaaS compared.
Choosing between them
| If your situation is | The right answer is usually |
|---|---|
| RTO measured in days is acceptable for most systems | Traditional backup, with tested restores |
| A handful of systems need hours, the rest can wait | Backup for the estate, DRaaS or replication for the critical few |
| Most of the business stops if IT stops | DRaaS for the critical estate, backup underneath it |
| You already own a second site with capacity | Replication, provided you will genuinely maintain and test it |
| A regulator or contract specifies recovery times | Whatever meets the requirement demonstrably, with test evidence |
| You have backup but have never tested a restore | Stop and test. You may not have what you think you have |
Table 3 — Matching approach to circumstance.
Questions to ask a DRaaS provider
- What RPO and RTO are contractually committed, as opposed to described in marketing material?
- How often can we test, is testing disruptive, and is it included in the price?
- What is the declaration process, who can invoke it, and how quickly do you respond?
- What happens during a regional event when many customers declare simultaneously?
- How do we fail back, how long does it take, and what does it cost?
- What is included and what is billed separately during an actual invocation?
- Where is our data held, and does that satisfy our residency obligations?
- What are the exit terms and how do we get our data out?
Where to go next
- Disaster recovery terms to know
- Disaster Recovery Services
- BC/DR Planning
- Preparing for an IT security audit
Frequently Asked Questions
What is the difference between backup and disaster recovery?
Backup is a copy of data you can restore from. Disaster recovery is the capability to resume operations, which includes infrastructure, networking, sequencing and a tested plan. Backup is one component of disaster recovery, not a substitute for it.
What is DRaaS?
Disaster Recovery as a Service: a provider maintains a standby copy of your environment ready to run, so you can fail over to their infrastructure rather than rebuilding on your own. It converts recovery from a project into a procedure.
Do we still need backup if we have DRaaS?
Yes. Replication copies whatever is on the primary, including ransomware encryption and accidental deletion. Backup gives you a point-in-time copy from before the problem occurred.
How often should we test disaster recovery?
At least annually, and after significant infrastructure change. Many DRaaS providers support non-disruptive testing, which makes more frequent testing practical. An untested plan is an assumption.
How do we decide our RPO and RTO?
Per system, based on business impact. Ask what happens after one hour, one day and one week of unavailability, and what volume of lost data would be tolerable. The answers usually differ sharply between systems.
Talk to Consult Circle
We design and deliver disaster recovery services, including RPO and RTO definition, solution selection and regular tested failover. Book a free 30-minute call - 0203 916 5593 - info@consultcircle.com