Backup & Disaster Recovery
for SMEs
Backup scoping starts with data, risks, dependencies, recovery objectives and responsibilities. Architecture, monitoring and test frequency are those in the proposal and contract.
The 3-2-1 rule is a starting point, not a guarantee. Tools, off-site copies, immutability, retention and testing must be adapted to risks and confirmed in writing.
Why is backup the most critical component of your IT?
Ransomware encrypts your files within minutes. A hard drive fails without warning. An employee accidentally deletes a critical shared folder. Without a reliable, tested and offsite backup, these scenarios turn into disasters — sometimes into permanent closure.
The 3-2-1 rule — the minimum backup standard
Recommended by ANSSI and adopted by every serious MSP, the 3-2-1 rule is straightforward:
The 3-2-1-1-0 variant adds an immutable copy and restoration verification. Its applicability, tools and test frequency must be defined for the relevant scope.
Full, incremental or differential backup?
| Type | Description | RPO | Storage |
|---|---|---|---|
| Full | Complete copy of all data. The safest but slowest and most storage-intensive. Ideal as a weekly starting point. | Variable | High |
| Incremental | Copies only files changed since the last backup (full or incremental). Fast and storage-efficient. | < 24h | Low |
| Differential | Copies all files changed since the last full backup. Faster to restore than an incremental backup. | < 24h | Medium |
This is one possible architecture. Frequency, retention, replication and RPO/RTO objectives must be defined and validated through tests for each environment.
DRP vs BCP — Disaster Recovery Plan vs Business Continuity Plan
DRP — Disaster Recovery Plan
Goal: resume operations after a disaster within a defined timeframe (RTO). Accepts a period of downtime. Suited to the majority of SMEs. Moderate cost.
BCP — Business Continuity Plan
Goal: maintain operations without interruption. Requires redundancy (clustered servers, real-time replication). High cost. For business-critical activities.
For an SME with 5 to 120 workstations, a DRP with a 4-hour RTO is the best cost-to-protection ratio. Externalised backups combined with a priority response contract allow you to recover quickly without over-investing in redundant infrastructure.
Veeam, Acronis and cloud solutions — what we deploy
Veeam Backup & Replication
The benchmark for virtualised environments (VMware, Hyper-V). Granular restoration, replication, immutable backups. Ideal for SMEs with on-premises servers.
Acronis Cyber Protect
Unified backup + antivirus + anti-ransomware solution. Centralised cloud console. Excellent for SMEs with a mix of workstations and servers.
Encrypted cloud backup
Externalisation to French datacenters (HDS-certified for health data). AES-256 encryption at rest and in transit. Configurable retention policies.
Microsoft 365 Backup
Microsoft 365 does not back up your data by default. We deploy a third-party solution (Veeam for M365 or Acronis) to protect Exchange, SharePoint and OneDrive.
From audit to continuous protection — 6 steps
Business Impact Analysis (BIA)
Identification of critical systems, assessment of hourly downtime costs, definition of recovery priorities.
RPO / RTO Definition
RPO (Recovery Point Objective): how much data can you afford to lose? RTO (Recovery Time Objective): how quickly must you be back up and running?
Backup Architecture
Implementation of the 3-2-1 rule, selection of solutions (Veeam, Acronis), configuration of local and cloud replication.
Documentation & Procedures
Drafting the recovery plan, decision trees, emergency contacts, step-by-step restoration procedures.
Restoration Testing
Monthly full restoration tests in an isolated environment. Measurement of actual RTO. Documented reporting.
Continuous Improvement
Quarterly DRP review, updates after each infrastructure change, annual disaster simulation exercise.
How much does managed backup cost for an SME?
| Scope | Indicative price | Included |
|---|---|---|
| Workstations | €5 — €15 / workstation / month | Incremental backup, encrypted cloud, monitoring |
| Servers | €50 — €200 / server / month | Veeam/Acronis, replication, restoration tests |
| Full DRP | On request | BIA, documentation, monthly tests, guaranteed RTO |
"At ECLAUD IT, workstation backup is included in the managed IT service. For servers and DRP, we offer dedicated packages with monthly documented restoration tests — that part is non-negotiable."— Enrico Claude, founder of ECLAUD IT
FAQ — Backup and Disaster Recovery
What is the 3-2-1 backup rule?
The 3-2-1 rule recommends keeping 3 copies of your data, on 2 different media types (local disk + cloud, for example), with 1 copy stored offsite (remote datacenter or cloud). This is the minimum standard recommended by ANSSI for any business.
What is the difference between a DRP and a BCP?
A DRP defines recovery objectives and procedures after an incident. A BCP covers the measures intended to maintain prioritised activities. Neither label guarantees zero downtime; objectives, dependencies, tests and residual risks must be documented.
How much does managed backup cost for an SME?
Managed backup costs between €5 and €15 per workstation per month and between €50 and €200 per server per month, depending on data volume and retention. At ECLAUD IT, backup is included in the managed IT service. For a full DRP with monthly testing, a dedicated package is available on request.
How often should backups be tested?
ANSSI recommends testing restoration at least once per quarter. At ECLAUD IT, we test monthly by restoring a data sample in an isolated environment. Every test is documented with the measured restoration time.
Veeam or Acronis: which solution should you choose?
Choice depends on systems, hypervisors, workstations, recovery objectives, licences, compatibility and responsibilities. Check current vendor features, then confirm the product and scope in the proposal.
What happens if ransomware encrypts my backups too?
This is the primary risk if your backups reside on the same network as your workstations. The 3-2-1 rule with an offsite (air-gapped or immutable) copy protects against this scenario. Veeam and Acronis offer immutable backups that even a compromised administrator cannot delete.
Is your data
truly protected?
Scope, authorised tests, deliverables, schedule and price are confirmed before a backup audit begins.