Data Backup and Disaster Recovery for Irish Businesses
On this page
Backups are the one security measure where being 90% right equals being 100% wrong. A business that backs up to the same machine it is protecting, or has never tested a restore, has a ritual rather than a recovery capability. This guide is the practical plan, sized for Irish SMEs.
The 3-2-1 rule
Keep three copies of your data, on two different types of media, with one copy off-site. For most Irish SMEs that translates to: the live system, a local or secondary copy, and an encrypted cloud copy in a different region or provider. Two copies on one server is not two copies.
Set the two numbers first
- RPO, recovery point objective: how much data you can afford to lose, in time. One hour of order data? One day of email? The answer sets backup frequency.
- RTO, recovery time objective: how fast you must be running again. A shop can tolerate hours; a booking business cannot.
Write both numbers down before choosing tools. Most backup failures are actually planning failures: nobody defined what recovery had to look like.
What to protect
Website and database, customer and order records, accounting data, documents and email, and system configuration. For each item, record where it lives, how it is backed up, and who restores it. If a single person knows the recovery process, you do not have a recovery process.
The shared responsibility model
Cloud providers protect their infrastructure; your data is your responsibility. Managed databases often include point-in-time recovery, but files, configuration, and third-party SaaS data (email, CRM, accounting) are commonly unprotected unless you arrange it. Close every gap explicitly.
Test, or it does not count
- Restore a sample file monthly.
- Run a full recovery drill quarterly, against the clock, measuring against your RTO.
- Rotate credentials and verify the off-site copy is actually accessible, including from a different location than the office.
Immutable and offline copies
Ransomware targets backups first. Keep at least one copy immutable or offline so an attacker who owns your systems cannot delete the backups with them. This is the lesson our data plane hardening case study applies to production systems, and the storage discipline in our media storage pipeline case study.
How we deliver it
We build backup and recovery into every system we run: automated snapshots, off-site copies, tested restores, and documented runbooks with your RTO and RPO as the targets. Book a call and we will audit what you have today against the 3-2-1 rule and show you the gaps.
Frequently asked questions
What is the 3-2-1 backup rule?
Keep three copies of your data, on two different types of media, with one copy stored off-site. It is the minimum sensible standard, and most businesses fail it.
How often should I back up?
Daily at minimum for business data. Anything you cannot afford to lose for more than a day needs more frequent or continuous backup. The right cadence falls out of your RPO.
What is the difference between RTO and RPO?
RPO is how much data you can afford to lose, measured in time. RTO is how fast you need to be running again. A backup strategy is only correct if it meets both numbers.
Are cloud providers responsible for my backups?
No. Cloud providers are responsible for their infrastructure, but your data and its recovery are your responsibility under the shared responsibility model. Managed backup is a choice you must make.
How do I know my backups actually work?
Test restores. A backup that has never been restored is a hope, not a backup. Restore a file monthly and run a full recovery drill quarterly.
What should a small Irish business back up?
Website and database, email and documents, accounting and customer records, and the configuration of your systems. If losing it would stop the business for a day, it belongs in the plan.