Backup Is Not Disaster Recovery: What Every Singapore SME Should Know

A backup is a copy of your data. Disaster recovery is the plan, equipment and practice that get the business working again after something serious goes wrong. A company can have perfect backups and still be closed for a week, because the server to restore onto has not arrived, nobody knows the order to rebuild things in, and restoring four terabytes from the cloud takes days. The useful way to tell them apart is to ask two questions the business, not IT, must answer: how much recent work can we afford to lose, and how long can we operate without our systems? Those two numbers, the recovery point objective and the recovery time objective, turn backup from a habit into a plan.

What is the difference?

What are RPO and RTO?

Recovery point objective (RPO) is the maximum amount of recent data you accept losing, expressed as time. It is set by how often you back up or replicate.

Recovery time objective (RTO) is the maximum time a system may be unavailable. It is set by how quickly you can restore and by whether you have somewhere to restore to.

CALC. An office backs up once a night at 1am. The file server fails at 5pm. Everything created since 1am is gone: 16 hours, which for ten staff is 10 x 8 working hours = 80 staff-hours of work to redo. The RPO in practice is up to 24 hours. Hourly snapshots would cut the worst case to one hour.

If recovery then takes two working days because a replacement has to be bought and the restore run, ten staff are idle or improvising for 10 x 2 = 20 staff-days. That is the real RTO, whatever the plan says.

Could your business manage 48 hours without its files?

It is a fair test. Walk through it honestly:

• Can staff quote, invoice and reply to customers?
• Are there deadlines, such as tenders, filings or payroll, that would be missed?
• Do customers or regulators have to be told?
• Which systems are needed first, and which can wait a week?

Most SMEs find that a few things are needed within hours, such as email, the accounts system and current project files, while archives can wait. That ranking is the heart of a recovery plan, because fast recovery is expensive and should be bought only where it matters.

How do you match the method to the target?

Different systems can sit on different rows. Replication deserves a caution: it copies changes quickly, including deletions and encryption, so it shortens downtime but does not replace versioned backups. You need both.

Backup is something you have. Recovery is something you can do. Only one of them has been proved until you test.

What goes into a simple recovery plan?

1. A ranked list of systems with an RPO and RTO for each, agreed by management.
2. Where the copies are, including one off site and one that cannot be altered. See the 3-2-1 backup rule.
3. Where you would restore to. Spare hardware, a second NAS able to run services, a supplier commitment, or cloud capacity.
4. The order of recovery and written steps a competent outsider could follow.
5. Access that survives the disaster. Passwords, licence keys and the plan itself, stored somewhere other than the system that failed.
6. People. Who decides, who does what, and who to call: internet provider, IT supplier, insurer.
7. How staff work meanwhile and how customers are informed. See can your business still communicate.
8. Obligations. In Singapore, a data breach involving personal data may need to be assessed and notified under the Personal Data Protection Act within set timeframes. Know who is responsible.
9. A test schedule. At least yearly: restore a key system for real and time it.

What do tests usually reveal?

• The restore takes several times longer than assumed.
• A backup job has been failing unnoticed.
• The password for the backup system was stored on the server that failed.
• A licence is tied to the old hardware.
• Only one person knows how, and they are on leave.

Each of these is cheap to fix in advance.

Where do power and hardware fit?

Many small disasters are avoidable: a UPS lets servers and NAS shut down cleanly in a power cut, and redundant drives absorb a single failure. Prevention narrows how often the plan is needed; it does not remove the need. See your UPS battery might be dead before you realise and, on the cost of being offline, the hidden cost of business downtime.

Buying in Singapore

On-site backup with frequent snapshots: the Synology DS925+ (S$1,260) or Synology DS1825+ (S$2,148). Off-site or protected copy: the Synology ActiveProtect DP320 (S$2,611.20) or DP340 (S$6,526.80). Power protection: the APC Back-UPS Pro BR 900VA (S$452.50) (listed 12 Nov 2026; prices change; ask for a current quotation). To start, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.

Frequently asked questions

What is the difference between backup and disaster recovery? Backup is keeping copies of data. Disaster recovery is the plan, resources and practice needed to restore systems and resume business after a major incident.

What is RPO? Recovery point objective is the maximum amount of recent data, measured in time, that a business accepts losing. It is determined by how often data is backed up or replicated.

What is RTO? Recovery time objective is the maximum time a system can be unavailable before the impact becomes unacceptable. It is determined by how fast systems can be restored.

Does a small business need a disaster recovery plan? Yes. It can be short: a ranked list of systems, targets for each, where the copies are, where to restore to, who does what, and a yearly test.