Backup and Disaster Recovery: A Practical Guide for Nigerian SMEs

Backups are not disaster recovery

A backup is a copy of your data. Disaster recovery is the ability to get the business running again after something goes wrong. You need both. Many organisations discover only during an emergency that their backups were incomplete, corrupted or impossible to restore, and that they had no plan for what to do next.

What can go wrong

• Hardware failure: disks and servers wear out.
• Power surges and outages that damage equipment or corrupt files.
• Human error: accidental deletion or overwriting.
• Ransomware and other malware that encrypts or destroys files.
• Theft, fire or flooding at your premises.
• Failures at a software or hosting provider.

Two numbers to decide first

Recovery Point Objective (RPO) is how much recent data you can afford to lose, for example one hour or one day. Recovery Time Objective (RTO) is how long you can afford to be offline. These two figures determine how often you back up and what kind of recovery setup you need. A shop that can re-enter a day of sales has different needs from a platform processing payments continuously.

The 3-2-1 rule

A well-known guideline is to keep three copies of your data, on two different types of storage, with one copy stored off site. For example: the live data on your server, a second copy on a separate network storage device, and a third copy in encrypted cloud storage. Add an immutable or offline copy if ransomware is a concern, so an attacker cannot delete every version.

What to back up

• Databases, which are usually the most valuable asset.
• Uploaded files and documents.
• Application code and configuration, including environment settings.
• Email and shared drives.
• Server and network configuration, so you can rebuild quickly.

Test your restores

The most important step is the one most often skipped. Regularly restore a backup to a test system and check that the data is complete and the application runs. A backup that has never been restored is only a hope. Schedule restore tests at least every quarter and record how long they take, because that is your real recovery time.

Plan for people and power

Write a short recovery plan that lists who does what, in what order, with contact details and where the credentials and documentation are stored securely. Protect equipment with surge protection and properly sized UPS units, and consider a generator or inverter backup where the grid is unreliable. For internet, a second connection from a different provider keeps cloud tools and communications available.

Start simple and improve

If you have nothing today, begin with automatic daily backups of your most important data to a separate location, add a cloud copy, and run your first restore test within the month. Then refine the plan as your business grows.