This blog was originally published June 17, 2025
Backup is not disaster recovery, and most businesses running Microsoft 365 only have the first one properly in place. That distinction decides what happens when a server fails, a cloud outage hits, or ransomware locks a shared drive, and whether a professional services firm gets back to billable work within hours or loses a full working day figuring out where the data is and how fast it can come back.
For a law firm or an accounting practice, that time has a direct cost. Every hour spent waiting on files is an hour of billable work gone for good, and a missed filing deadline or a late client deliverable costs more than the hours themselves.
Backup and disaster recovery cover two different risks
Backup is the copy of your data sitting somewhere safe. Disaster recovery is the process that gets the business running again after something goes wrong, using that copy. A firm can have reliable backups and still have no real disaster recovery plan, because no one has worked out how long a full restore takes, in what order systems come back, and what the business does while that happens.
Recovery time objective is how long the business can function without a given system before the disruption turns serious, measured in hours. Recovery point objective, which NIST defines as the point in time to which data must be recovered after an outage, is really about how much work a firm can afford to redo. A firm backing up once overnight has a recovery point objective of close to 24 hours, meaning a full day of casework could be gone if something happens late in the afternoon. Put plainly to your own firm, how many hours could you go without your case files, and how much of today’s work could you afford to redo from scratch? Those two answers are the real starting point for building a disaster recovery plan.
Why Microsoft 365 backup alone will not cover disaster recovery
Most firms running Microsoft 365 assume Microsoft is already handling backup, since the data lives in the cloud and the cloud feels like someone else’s problem. Microsoft’s own documentation says otherwise. Under what Microsoft calls the shared responsibility model, the customer remains responsible for their own data across every type of cloud deployment, software as a service included. Microsoft keeps the platform running. The firm is responsible for protecting what sits inside it.
A Microsoft 365 subscription is the platform a firm builds on. It was never designed to be the backup that protects what gets built on top of it.
In practice, the retention and recycle bin features built into Microsoft 365 undo small accidents over a limited window, recovering an email deleted yesterday or a file version from last week. They do little for a ransomware attack that encrypts files across the whole environment or for a staff member who deletes a client folder that goes unnoticed for weeks. Once that window closes, the data is gone unless the firm holds an independent copy, stored outside Microsoft 365, that does not depend on the live environment staying healthy.
What a tested data recovery plan for business must include
Running the actual restore is the only way to know whether a recovery plan works. Confirming that a backup job completed tells a firm nothing about whether the data comes back intact or how long that recovery takes under real conditions. CISA recommends running an actual recovery drill to confirm backups can truly be restored, a higher bar than just checking that a backup job ran. Firms that skip this step often find out during a real incident that a restore that looked fine on paper takes three or four times longer than expected or that a block of recent files never made it into the backup at all.
Testing is only part of it. The plan itself needs to live somewhere the firm can reach if the network and file servers are what failed, which rules out keeping the only copy on the server it is meant to recover. A workable plan names which systems and files come back first, the order after that, and who makes that call if the managing partner cannot be reached. It should also list an alternate way to reach the IT partner and key vendors if email itself is down, since that is often the first thing ransomware takes out. Everyone else mainly needs to know who is in charge until normal service returns, including who speaks to clients if a deadline slips.
Firms that work this out ahead of time tend to get through an incident in hours, because no one is arguing about who is in charge while the clock runs.
Find out your firm’s recovery time objective
A tested recovery plan protects billable hours and the client relationships that depend on hitting deadlines. Knowing how long recovery takes, what order it happens in, and who owns which part of it turns a backup into something a firm can depend on.
Firms across Arlington and Vienna running Microsoft 365 most often have backups in place. The recovery plan is the piece still missing.
If your firm cannot say what its recovery time objective is, that is the first thing to work out with your IT partner. BASE Solutions defines recovery time targets before any backup gets configured, then tests the plan against them.
FAQs
Do I need to back up Microsoft 365 if I already pay for it?
Yes. Microsoft keeps the platform available, but under its own shared responsibility model, protecting your data sits with you. Retention and recycle bin settings are not a substitute for an independent backup stored outside Microsoft 365.
What is the difference between backup and disaster recovery?
Backup is the copy of your data. Disaster recovery is the plan and process that gets your business running again using that copy, including how long it takes and in what order systems come back. A firm can have one without the other.
How much does a disaster recovery plan cost for a small professional services firm?
Cost tracks your recovery time objective and recovery point objective more closely than it tracks hardware. A plan built around realistic targets for a firm of 10 to 150 people costs far less than enterprise-grade high availability, and most of the early spend goes into planning and testing.
Can a disaster recovery plan protect against ransomware?
Yes, if backups are kept independent of the live environment and tested regularly. Ransomware that encrypts or deletes data on the network cannot reach a backup stored outside that environment, which is why where backups live counts as much as whether they exist.
What is a good recovery time objective for a small business?
There is no single industry number. Most professional services firms find anything beyond a full working day unacceptable, since billable hours and client deadlines start slipping almost immediately. The right recovery time objective comes from asking how long your firm could genuinely function without its core systems.
