Backup and Disaster Recovery for SMEs: 3-2-1 and Immutability

If a laptop dies, a cloud app misfires, or ransomware locks your files, how long could you operate without your data? For many SMEs, the honest answer is not long.

Business continuity rests on one simple idea: when something fails, you can still serve customers. That takes planning, tested backups, and clear roles when the pressure is on. This guide explains the building blocks in plain English, so you can choose the right mix of on-site and cloud backups, set realistic recovery objectives, and rehearse for when it truly matters.

At Jedi Services, we help SMEs design, deploy and monitor backup and disaster recovery that actually works on the day. Below is the practical blueprint we use with clients, plus a readiness worksheet and a recovery runbook outline you can adapt.

Start with the two numbers that matter: RPO and RTO

Two targets guide every backup decision.

• Recovery Point Objective (RPO): how much data you can afford to lose. If your RPO is 1 hour, you will take hourly backups so a restore loses at most an hour of work.
• Recovery Time Objective (RTO): how quickly you need systems back. If your RTO is 4 hours, your restore method and capacity must bring you back within that window.

Agree RPO and RTO per system. Email and file shares might tolerate a 2 hour RPO and a same day RTO, while your point-of-sale or production system may need tighter targets. Be realistic, then align technology and budget to those goals.

The 3-2-1 rule that keeps you recoverable

A simple framework keeps you resilient without overcomplicating things:

• Keep 3 copies of your data, your production copy plus two backups.
• Store them on 2 different media or platforms, for example local appliance and cloud object storage.
• Ensure 1 copy is off-site, protected from local incidents like theft or fire.

This is the baseline. For higher risk systems, add more frequent snapshots or an additional copy in a separate cloud region.

Why immutable backups stop ransomware in its tracks

Modern ransomware tries to encrypt backups as well as live systems. Immutability means a backup copy cannot be changed or deleted for a fixed retention period. Think of it as a read-only time capsule. Even if an attacker gains admin access, they cannot alter, encrypt or purge those snapshots.

Combine immutability with versioning and you can roll back to a clean point-in-time, often avoiding ransom decisions entirely. Many SME-friendly platforms support immutable storage and snapshot locking. Jedi Services designs policies so critical datasets always have at least one immutable off-site copy and a tested restore path.

On-site versus cloud: choose a blend

Each option brings strengths. Most SMEs benefit from a hybrid approach.

• On-site backup appliance: fastest local restores for user errors and small outages, useful for rapid file recovery and bare-metal restores to replacement hardware. Vulnerable to site incidents unless paired with off-site copies.
• Cloud backup or replication: resilient to local failures, power loss and theft. Excellent for immutable storage and cross-region redundancy. Restores over the internet can be slower unless you plan for image-based recovery or cloud virtualisation.

The sweet spot is often local image backups for speed plus cloud-based immutable copies for resilience. Platforms like Datto can go further, providing image-level backups with on-site caching and cloud virtualisation so you can boot your server as a cloud VM while you fix hardware on-prem.

Rapid restore options, including full-system images

File restores are not enough during a major outage. Aim for multiple recovery modes:

• File and folder restore for accidental deletion or corruption.
• Image-based recovery to new hardware or a virtual host for failed servers.
• Virtualise in the cloud to meet tight RTOs while you repair or replace equipment.
• SaaS backups for Microsoft 365 to recover mailboxes, SharePoint and OneDrive beyond native recycle-bin limits.

Datto-style image backups let you perform instant virtualisation locally or in the cloud. That agility often makes the difference between a lost day and a minor blip.

Test restores: what to test and how often

Backups are only as good as your last successful restore test. Set a cadence:

• Monthly: spot-check file restores from recent points.
• Quarterly: perform image restore drills for a key server or VM, verify boot, application access and data integrity.
• Annually: run a full recovery exercise against your RTO and RPO targets, document results and refine your runbook.

Record timings, any errors, who was involved and what improved. Treat it as a rehearsal, not a pass or fail exam.

Cloud Backup & Recovery

Don't leave your data to chance. We provide secure, automated backups for your servers, Microsoft 365, and Google Workspace with rapid recovery options.

Readiness worksheet you can copy

Use this quick worksheet to baseline your position.

• Systems and data: list critical systems (email, finance, ERP, file shares, websites) and data locations, including SaaS.
• RPO and RTO: set targets per system, note business impact if missed.
• Backup inventory: methods in place (file level, image level, SaaS), frequencies, retention, immutability status, off-site location.
• Restore paths: file restore steps, image restore targets, cloud virtualisation availability, contact details for vendors.
• Roles and access: who can trigger restores, who holds admin credentials and MFA tokens, who communicates with stakeholders.
• Test schedule: last test date and result, next test date, responsible owner.
• Gaps and actions: missing immutability, slow RTO, single points of failure, budget and timeline to address.

If you use Microsoft 365, add third-party backups to cover mailbox, OneDrive and SharePoint restore needs. Jedi Services provides IT support for Microsoft 365 and can align retention with your compliance requirements.

Recovery runbook outline

When time is tight, a clear runbook keeps everyone focused.

• Trigger and triage: how incidents are reported, who decides to initiate recovery, initial containment steps (isolate devices, revoke sessions).
• Decision matrix: which systems recover first, based on customer impact and dependencies.
• Technical steps: per system, list restore method, target environment, credentials, MFA method, and validation checks.
• Communications: internal updates, customer notices, supplier coordination. Keep messages factual and time bound.
• Evidence and forensics: preserve logs and snapshots, capture artefacts before wiping systems.
• Return to normal: criteria to fail back from cloud virtualisation to on-prem, post-incident patching and hardening.
• Post-mortem: document timeline, what worked, what to improve, and update the runbook.

Cyber risks to plan around

Ransomware dominates headlines, but do not overlook other common threats that trigger recoveries. Five prevalent cyber security threats:

• Phishing and social engineering leading to credential theft or unauthorised access.
• Malware and ransomware that encrypt or destroy data.
• Vulnerability exploitation of unpatched systems and exposed remote access.
• Insider threats, from accidental deletion to malicious sabotage.
• Supply chain compromises where a trusted tool or partner is breached.

If you want a broader view of layered protections, explore our practical guide to cybersecurity solutions for businesses. It outlines controls that reduce the chance you will need to restore in the first place.

FAQ

Why should I back up my data? Backups protect your business from human error, hardware failure, software bugs and criminal activity. With defined RPO and RTO, you can restore quickly to a recent point, maintain continuity and avoid paying ransoms.

What are effective cyber security solutions for SMEs? Adopt layered controls: MFA on all accounts, a password manager, managed endpoint security, timely patching, advanced email filtering with DMARC, network segmentation, and continuous monitoring. Pair this with tested, immutable backups and a runbook so you can recover fast. For help getting the basics right, our Cyber Essentials guidance is a solid starting point.

What are the five main cyber security threats today? Phishing and social engineering, malware and ransomware, unpatched vulnerabilities and exposed services, insider threats, and supply chain compromises.

How Jedi Services helps SMEs stay recoverable

We design and run BDR that fits your targets and budget. Typical engagements include:

• Architecture and deployment: 3-2-1 aligned design, immutable off-site copies, image-based backups and cloud virtualisation options such as Datto-class solutions.
• Monitoring and maintenance: backup health checks, alerting, retention tuning and quarterly restore tests with documented outcomes.
• Microsoft 365 and hybrid coverage: SaaS backups, on-site appliances, and cloud replication blended for speed and resilience.
• Incident support: containment, forensics and guided recovery to validated clean states.

If you are based in Hertfordshire or the capital, our team delivers remote and on-site support. Learn more about our London IT support and regional services.

Summary and next step

A strong backup and disaster recovery plan is not about buying more storage. It is about clear RPO and RTO targets, the 3-2-1 rule with immutability, hybrid on-site and cloud coverage, and regular restore testing so there are no surprises. Use the worksheet to capture where you are today, then build a runbook you can trust.

Ready to tighten your continuity plan? Jedi Services can assess your environment, implement immutable backups and schedule realistic recovery drills, so you stay confident under pressure. Reach out to our team to get started.