How a small business builds a backup strategy that actually saves its data

Monday morning, quarter to nine. You open the accounting computer and instead of the billing files you see a simple text file with payment instructions in bitcoin . No customer photo opens, no spreadsheet, no contract.

This is not a movie script. It happens to thousands of small and medium-sized businesses every year, and what separates a bad day from an outright disaster is whether there was a real backup and disaster recovery strategy in place — not a USB stick forgotten in a drawer.

In this guide, you won't find general advice like "make regular backups." You'll see specific steps, numbers, and decisions that a Greek SME can take without a ten-person IT department and without an unlimited budget.

We start from the foundation, move on to the implementation steps, and close with the mistakes we see repeated over and over again in small businesses.

Backup strategy vs disaster recovery: two different things

The two terms are used interchangeably, but they are not. A backup is a copy of your data — your files, your database, your emails. A disaster recovery is a plan that describes what you do when something really goes wrong: how you get your server, network, applications, and people back up and running, not just your files.

A business can have a perfect backup and at the same time zero disaster recovery plan. It has its files, but it doesn't know how many hours it will take to rebuild its cash register, e-shop or ERP. This gap between "I have a copy" and "I can work again" is where the most money is lost.

Why does this matter now? According to research by Check Point presented on techpress.gr , 2.122 businesses and organizations fell victim to ransomware in the first quarter of 2026 alone, the second highest quarter ever recorded. The ten most active ransomware groups are now responsible for 71% of victims, indicating more organized and aggressive attacks compared to 2025.

In other words: we're no longer talking about "if" something happens to you, but about how quickly you'll be able to get back up. That's where backup and disaster recovery strategy comes in as a single plan, not as two separate checkboxes.

The 3-2-1-1-0 rule: the foundation that hasn't changed

Until recently, the classic 3-2-1 rule was sufficient: three copies of data, on two different storage media, with one off-site. But new-generation ransomware now directly targets the backups themselves before encrypting the rest of the infrastructure, so the industry has added two more requirements, as iFeeltech explains in detail in its guide to the 3-2-1 rule : an immutable or offline copy that no one can remotely delete, and zero errors in a test recovery.

💡 Pro-Tip: If your backup is on the same network and with the same passwords as your production data, you essentially don't have a second copy — you have one more point that can be encrypted along with everything else.

Even large organizations are rethinking their backup thinking; Google itself recently changed its backup strategy to respond to more sophisticated threats — a sign that “backup once and forget it” is no longer enough, even for the big players.

At the implementation level, most small businesses choose between on-premises, cloud, or hybrid models. There is no “right” way; there is one that is right for each business’s size and risk.

For most Greek SMEs, the hybrid model provides the best balance: fast local recovery for everyday "misfortune" (a broken disk, an accidentally deleted file) and an off-site cloud copy for the fire, flood or ransomware scenario.

RPO and RTO: the two numbers that no one explains properly

Recovery Point Objective (RPO) answers the question “how much data can I afford to lose?” If you back up once a night and the system crashes at 5 p.m., your RPO is a full day of work. Recovery Time Objective (RTO) answers another question: “how many hours will I be down until I can work again.”

In practice, we’ve seen in small business recovery tests that RTO is often vastly underestimated. An accounting firm might think it will be back up and running in two hours, but when it needs to download terabytes of data from the cloud with an office connection, the reality is more like a full workday.

But the problem doesn’t stop there. Not every system needs the same RPO and RTO. An e-shop with real-time orders might need an RPO of under an hour, while a file of old invoices can tolerate an RPO of 24 hours without a problem. Defining different goals per system is what makes a backup strategy realistic instead of a general plan on paper.

⚠️ Reality Check: Many backup solutions' marketing talks about "instant recovery." In practice, the speed of your office's internet line determines the actual RTO much more than the backup software itself.

Step-by-step: backup & disaster recovery plan in 6 steps

Let's get to the point. These are the steps a small business needs to go from "we'll probably do some backup" to a plan that actually works when needed.

1. Data inventory: Record where all critical data is located — servers, laptops, SaaS applications, email, accounting software.
2. RPO/RTO definition per system: Not a single goal for everything, but separate levels depending on the importance of each system.
3. Tool selection: Combine local NAS for fast recovery with cloud storage for off-site backup.
4. Automation and encryption: The backup should run on its own, at scheduled times, with encryption both during transfer and at storage.
5. Definition of responsible person: Someone specific—not “the IT team” in general—should regularly check that backups are completing without errors.
6. Recovery tests: Schedule real restore tests, not just a simple check that "the backup file exists."

The sixth step is the one that almost every small business skips, and it’s the one that makes the difference between a theoretical plan and a real one. If you want to see how professional IT service providers organize this process, check out the MSP security and recovery review webinar we covered, where recovery testing is presented as just as important as the backup itself.

The 5 mistakes that almost all small businesses make

The truth is not always pleasant, but it needs to be spoken clearly.

• Backup on the same network, without isolation: An external drive permanently connected to the same PC does not protect against anything serious.
• Nobody tries restore: A backup that has never been tested is just a working assumption, not a guarantee.
• Absence of immutable copy: Without a copy that cannot be deleted or encrypted remotely, ransomware has free rein.
• No specific person responsible: When the responsibility is "the team's," it usually belongs to no one.
• Blind trust in the cloud: Many believe that ecosystem 365 or Google Workspace automatically perform full backups of their data. In reality, both providers operate on a shared responsibility model; service availability does not equate to long-term protection of your data.

🔄 Alternative: If you don't have an in-house technical team at all, a managed backup service that also handles recovery testing makes more sense than a cheaper tool that no one will regularly check.

Why ransomware changed the rules of backup in 2026

Until recently, the logic was simple: if you get hit by ransomware, you restore from backup and move on. But modern attacks target backups themselves first, precisely because they know they are the victim's "safety net."

According to Sophos' annual State of Ransomware 2025 report , 97% of organizations that had data encrypted were ultimately able to recover it; however, the use of backups for recovery fell to its lowest rate in six years, which shows how often backups themselves prove to be inoperable or targeted when they are needed most.

The ENISA Threat Landscape confirms the same trend at the European Union level: phishing remains the main way of initial penetration, and the recommendation for resilience explicitly focuses on a reliable backup strategy with remote or offline copies.

Time context is also worth mentioning: a few years ago, ransomware attacks were relatively fragmented, by isolated groups. Today, as we covered in the increase in ransom demands from former BlackBasta members , we are talking about more organized, almost business-like structures, with targeted victim selection and much more aggressive negotiation tactics.

Technoid Reality: Backup is no longer just “backup.” It’s the reason a business will negotiate from a position of strength with a blackmailer — or be forced to pay because it has no other choice.

How much does a serious backup strategy cost in Greece?

Costs vary depending on size and requirements, but there are realistic options at every budget level.

For very small businesses with a few computers, a per-device cloud backup solution like Backblaze Business Backup costs around $99 per year per computer according to its published pricing — it’s always worth confirming the current price on the official website, as prices change. For businesses with their own server, a Synology NAS combined with cloud backup offers a good balance of cost and control, with the initial cost of the NAS paying for itself within a few years compared to pure cloud solutions.

📊 For businesses already using Microsoft 365 or Google Workspace, it is worth considering a separate backup service specifically for SaaS data (e.g. Veeam, Dropsuite), precisely because —as mentioned above— the platform itself does not fully cover the risk of data loss.

Until recently, the cost of a full backup strategy was considered a luxury for small businesses. Today, with the average cost of ransomware recovery running into millions of dollars for larger organizations and tens of thousands of euros even for smaller Greek businesses, the question is no longer “is backup worth the cost” but “how much does it cost to not have it?”

What to watch in the future: Cloud storage prices have been trending downward in recent years as more providers enter the market; however, the requirements for immutable copies and more frequent recovery tests are increasing operational costs. The net result is likely to remain relatively flat over the next 12–18 months.

Frequently asked questions about backup strategy and disaster recovery

What is the difference between a backup and a disaster recovery plan?

A backup is a copy of your data. A disaster recovery plan is the complete process that describes how you restore the entire operation of your business—server, network, applications, people—after a serious incident. You can have an excellent backup and at the same time not know how many hours it will take to get back to normal.

How often should a small business backup?

It depends on how much data you can afford to lose, i.e. the RPO of each system. Critical systems such as a cash register or e-shop often need backups every few hours, while archival data can tolerate a daily or even weekly cycle without any practical problem.

Does Microsoft 365 or Google Workspace automatically back up my data?

Not in the sense that many people think. Both platforms operate on a shared responsibility model: they guarantee the availability of the service, not necessarily full protection against accidental deletion, insider threat or ransomware. For full coverage, a separate backup solution specifically for SaaS data is usually required.

How much does a basic backup strategy cost for a small business in Greece?

For a few computers, solutions like cloud backup per device start at around $99 per year per computer. For businesses with their own servers, a local NAS combined with cloud backup has a higher initial cost but a lower cost over time. Always confirm the current prices on the official pages, as they change frequently.

What is immutable backup and why do I need it?

Immutable is the copy that cannot be modified or deleted, even by someone with administrator access, for a specified period of time . It is the only real defense against ransomware that first targets the backups themselves before encrypting the rest of the infrastructure.

How often should I try restore?

At least twice a year, ideally with a real test restore and not just a check that the backup file exists. A backup that has never been tested in a real recovery remains an unknown quantity until the moment you really need it.

If I pay the ransom to ransomware, will I definitely get my data back?

Not by definition. Paying a ransom does not guarantee complete or clean data recovery, and often significantly increases the total cost of recovery compared to recovering from a reliable, tested backup.

Do I really need an offsite copy if I already have a NAS in the office?

Yes. A NAS in the same building protects against disk failure or accidental deletion, but not against fire, flood, theft, or ransomware spreading across the entire local network. Off-site replication is what covers exactly these scenarios.

The point where a disaster recovery plan is truly judged

It’s not judged when you write it down in a document. It’s judged when someone actually has to do it, under pressure, without a plan, and usually outside of their normal working hours. The businesses that make it through this ordeal without disaster aren’t necessarily the ones with the most expensive backup software, but the ones that have already tested the recovery process before they actually need it. In 2026, with ransomware targeting backups themselves first, that difference will determine which small businesses will continue to operate after a crisis — and which will close their doors for good.