Backup and Disaster Recovery for Small Business

What backup and disaster recovery costs

For a 20 to 50 person business, published ranges run $300 to $800 a month for managed backup alone and $500 to $1,200 once quarterly disaster recovery testing is added ¹. Fully managed disaster recovery with defined recovery targets runs $1,000 to $3,000 a month ¹. These come from published provider guides, not a neutral survey, so treat them as a range to test quotes against.

The building blocks are priced separately:

• Server backup to the cloud: $25 to $75 per server per month ¹.
• Hybrid BDR appliance (a local device that keeps fast copies on site and replicates to the cloud): about $200 to $400 a month for one or two servers under 1 TB ¹.
• Microsoft 365 backup: roughly $3 to $5 per user per month in one provider's guide ². Veeam's list price starts at $2.63 per user per month ³. Microsoft's own Microsoft 365 Backup bills $0.15 per GB per month of protected data instead of per user ⁴.
• Cloud disaster recovery for servers: AWS Elastic Disaster Recovery lists $0.028 per hour per replicating server, which is about $20 per server per month by our arithmetic, before storage and the compute you use during a recovery ⁵.

Three terms get mixed up. Backup is a copy of your data. Disaster recovery is the ability to get systems running again from that copy. Disaster recovery as a service (DRaaS) means a provider keeps standby copies of your servers ready to start in its cloud, so staff can work from there while your own systems are rebuilt. Business continuity is the wider plan: who decides, how people work, how customers and suppliers are told.

Costs climb with data volume, server count, how fast you need to be running again and whether the provider tests recovery for you. If backup is bundled into a managed IT plan, ask which pieces are included. Our managed IT pricing guide shows what a typical per-user plan covers.

The 3-2-1 backup rule and immutable backups

The 3-2-1 rule says to keep three copies of your data on two different types of media, with one copy off site ⁶. It is still a good floor, but ransomware changed what off site has to mean. CISA warns that many ransomware strains look for reachable backups and delete or encrypt them, and tells organizations to keep offline, encrypted backups of critical data ⁷.

That is why most providers now add an immutable copy. An immutable backup cannot be changed or deleted by anyone, including an administrator, until its retention period ends. If an attacker steals an admin password, they still cannot wipe it. Some vendors call the updated rule 3-2-1-1-0: one copy offline or immutable, and zero errors in restore tests.

A sound small business setup has:

• A local copy for fast restores of single files or a whole server.
• A cloud copy in a separate account that your everyday admin logins cannot reach.
• Immutability or an offline copy, kept for at least several weeks so you can roll back past an infection that sat unnoticed.
• Encryption in transit and at rest, and MFA on the backup console.
• Failure alerts that go to a named person who acts on them.

Ask a provider to show you, on screen, where each of these lives. A reply of "it's in the cloud" does not answer the question.

RTO and RPO in plain words

Recovery time objective (RTO) is how long you can be down. Recovery point objective (RPO) is how much recent work you can afford to lose. NIST defines RTO as the length of time a system can be in recovery before it harms the organization's mission, and RPO as the point in time to which data must be recovered after an outage ⁸.

In office terms: if backups run every night at 11 p.m. and the server dies at 4 p.m., about 17 hours of work is gone. That is your real RPO. If it takes two days to get a replacement server and restore onto it, your real RTO is two days.

Setting targets is a business decision. Go through your main systems and ask what an hour of downtime costs and how much re-entered work staff could tolerate. Typical answers:

• Email and files: a few hours down may be survivable, but losing a day of mail is not.
• Accounting, ERP or practice management: same day recovery, very little data loss.
• Archive shares: a few days may be fine.

Tighter targets cost more. Two upgrades separate the low end of the published ranges from full managed DR at $1,000 to $3,000 a month ¹: snapshots every 15 minutes instead of nightly backups, and starting servers in the cloud instead of restoring onto new hardware. Regulators are heading the same way: the proposed HIPAA Security Rule update would require written procedures to restore certain systems and data within 72 hours, though it remains a proposal ⁹. Healthcare readers can see where that stands on our HIPAA compliance services page.

Microsoft 365 and cloud backup for small business

Cloud services keep your data available, but that is not the same as a backup you control. Microsoft 365 copies mail and files across its data centers so a failed disk will not lose them. It does not undo a user deleting a folder, an old employee's mailbox being removed, or ransomware encrypting synced OneDrive files, because those changes replicate too. Recycle bins and version history help for a while, then they expire.

That gap is why Microsoft sells its own Microsoft 365 Backup at $0.15 per GB per month ⁴ and why third-party tools run about $2 to $5 per user per month ²³. For a 30 person firm that is roughly $60 to $150 a month by our arithmetic, small next to losing a partner's mailbox.

What to check in cloud backup for business:

• It covers Exchange mail, OneDrive, SharePoint and Teams, not just mail.
• The copy sits outside your Microsoft tenant, or is immutable inside it.
• Restores are granular: one email, one file, one site.
• Retention matches your legal and contract obligations.

Google Workspace, CRM and line-of-business cloud apps raise the same question. If the business would stop without the data, it needs a copy that neither the vendor nor your own admins can destroy in one step. Our Microsoft 365 support guide covers licensing and administration.

Testing restores is the step most businesses skip

A backup you have never restored from is an assumption. CISA's guidance for small businesses tells IT leads to regularly test both partial and full restores ¹⁰, and its ransomware guide says to test the availability and integrity of backups in a disaster recovery scenario ⁷.

A workable schedule:

• Monthly: restore a few random files and one mailbox, and confirm they open.
• Quarterly: restore a full server or virtual machine into an isolated environment and time it against your RTO.
• Yearly: a tabletop exercise where leadership walks through a full outage: who calls whom, where staff work, what customers hear.

Ask for a written report each time, with the date, what was restored, how long it took and what failed. Insurers ask about backups on applications, and our cyber insurance requirements guide explains what underwriters look for. Providers that include quarterly testing sit in the $500 to $1,200 a month range in published guides ¹.

What ransomware recovery data says about backups

Backups decide whether a ransomware attack is a bad week or a ransom negotiation. In Sophos's 2026 survey of organizations with 100 to 5,000 employees, the average cost to recover from an attack was $1.7 million, and 48% of organizations whose data was encrypted paid the ransom ¹¹. Among US respondents, 60% used backups to recover encrypted data and the average recovery cost was $2.51 million ¹². Just over half (55%) were fully recovered within a week, and 16% in under a day ¹¹.

Two lessons for smaller firms. Recovery cost is mostly downtime, staff time, rebuilds and outside help, so faster restores save money even when no ransom is paid. And 79% of attacks in the same survey began with compromised identities ¹¹, which is why the backup console needs its own MFA and separate admin accounts. Backups are the last layer. The controls that stop attacks earlier are in our small business cybersecurity guide and our managed detection and response guide.

If an attack is happening now, the first steps are to contact your cyber insurer's hotline if you have a policy ¹⁵ and report it to the FBI at ic3.gov ¹³. Do not wipe, rebuild or restore over affected systems before evidence is preserved ¹⁴. Our incident response guide covers the first hours.

How to choose a BDR or DRaaS provider

Choose on proven recovery, not on storage price. These questions separate providers quickly:

1. What RTO and RPO will you commit to in writing for each system, and what does it cost to tighten them?
2. Where are the copies, which ones are immutable or offline, and for how long?
3. Can our admin accounts, or yours, delete the backups? What stops a stolen password from doing it?
4. How often do you test full restores, and will you send us the reports?
5. In a disaster, where do we run from, and who pays for the cloud compute while we do?
6. How do we get all our data back if we leave?

Business continuity planning services sit on top of this: a written plan for people, communications and suppliers. A cybersecurity risk assessment is a sensible way to rank which systems matter most before you set recovery targets. For the wider comparison of providers, see how to choose an MSP.