60% of small businesses that lose critical data close within six months. Most of them had "backups." Almost none had backups that were ever tested. Here's the 7-step framework we install for SMBs who want to find out before a real incident.
Get a free audit of whether your backups actually work40 to 60 percent of small businesses never reopen after a major data loss event. That's the figure the FEMA Ready.gov business preparedness program has been quoting for years, and it's the most uncomfortable number in this whole topic — because it doesn't measure businesses with no backups, it measures businesses that thought they had backups. Almost every SMB we audit has "nightly backups." Almost none of them have ever actually been restored. The first time they get restored — under pressure, on the worst day of the company — is when the founder finds out the backups have been silently failing for 11 months, or that the encryption key is on the laptop of an engineer who left, or that the backup is for the wrong database.
Disaster recovery isn't about buying a more expensive backup product. It's about a small set of boring, automated checks that run continuously so the worst day of your business doesn't also become the day you discover you have no backups. The 7 steps below are the exact framework we install for clients on AWS, Azure, or both — heavily informed by the AWS Disaster Recovery of Workloads on AWS whitepaper, which lays out the four standard recovery patterns we map every client to. The cousin framework for keeping your public site up — including its own restore-tested backups — is in our breakdown of why WordPress sites keep going down.
Most companies don't actually know what data is critical.
We mark your databases, file shares, configs, customer records, and anything regulated; everything else is recoverable from source.
How much data loss is survivable, and how long can you be down.
You decide in business terms; we design the system backwards from there.
Backups land in a separate cloud account in another region. Encrypted at rest.
Daily, hourly, or continuous depending on your RPO.
An object-locked weekly snapshot ransomware physically cannot delete.
The single most important backup most SMBs are missing.
Once a week, a script restores the latest backup to a clean sandbox account, runs checksums, and emails a green check.
Untested backups don't count.
Step-by-step, screenshots, named phone numbers.
Because on the day you need this, your CTO might be on a flight.
Once a quarter we simulate ransomware Friday at 5pm and watch the team walk through the runbook in real time.
We time it. We find the gaps. We fix them.
This is no longer optional if any of these are true today:
The framework above isn't theoretical — it's a checklist. Every gate has a defined output: an inventory document, a written RTO/RPO, a vault in another account, a locked weekly snapshot, a green Slack message every Sunday, a runbook a non-engineer can execute, and a quarterly drill on the calendar. None of it is exotic technology. It maps cleanly onto established standards — NIST SP 800-34, the federal contingency planning guide, and ISO 22301, the international business continuity standard — which is what most auditors and cyber insurers ultimately want to see evidence against.
The point isn't to make a disaster impossible — that's not on offer. The point is to make sure that when one happens, you already know your backups work, you already know who runs the restore, and you've already practiced. The U.S. Small Business Administration's emergency preparedness guidance says the same thing in plainer language: the businesses that survive disasters are the ones that practiced before the disaster. The difference between a company that survives a ransomware Friday and one that doesn't is almost never the size of the attack — it's whether they treated backups as something to prove instead of something to assume. And once you can prove it, the same numbers also drive your cloud cost optimization story: you stop paying to keep snapshots you'd never actually restore from.
We'll review what you back up, where it lands, who can delete it, and whether anyone has ever restored it. You'll get a clear report within 48 hours showing exactly which of the 7 gates above are missing — and what each would take to install.
Review my backup story (free)