Ask the owner of a small accounting, engineering, or consulting firm whether they're prepared for a disaster, and the answer is often, "We have backups."
That's a good start. But backups and business continuity aren't the same thing. Knowing the difference can determine whether a firm is back to work in a few hours or struggling for weeks.
The Short Version
- Backup is a copy of your data.
- Disaster recovery is the process of restoring your systems and data from those copies.
- Business continuity is your plan for keeping the firm operating and serving clients while recovery happens.
Think of it like a spare tire. The backup is the spare. Disaster recovery is changing the tire. Business continuity is figuring out how you'll still make your client meeting on time.
Side-by-Side Comparison
| Backup | Business Continuity | |
|---|---|---|
| Main question | Do we have a copy of our data? | How do we keep serving clients during a disruption? |
| Focus | Files, databases, email | People, processes, systems, and communication |
| Typical owner | IT provider or internal IT | Firm leadership with IT support |
| Measured by | How recent and complete copies are | How quickly the firm can operate again |
| Fails when | Copies are missing, corrupted, or encrypted | No one knows what to do or who decides |
Why Backups Alone Fall Short
Restoring takes longer than expected
A backup might contain everything you need, but restoring several hundred gigabytes of files and a practice management database can take a day or more. During that time, staff can't work normally.
Backups don't tell people what to do
When systems go down, someone has to decide whether to send staff home, how to contact clients, and which deadlines need extensions. A backup can't make those decisions.
Backups can be compromised
Ransomware often targets backups first. If your only backup is connected to the same network with the same passwords, it may be encrypted along with everything else.
Some things aren't backed up at all
Firms are often surprised to learn that certain cloud applications, email archives, or software configurations aren't included in their backup.
What Business Continuity Adds
A business continuity plan for a small professional firm usually covers:
- Critical functions: client deliverables, deadlines, billing, and communication.
- Recovery targets: a recovery time objective (how fast each system must return) and a recovery point objective (how much data you can afford to lose).
- Alternate work arrangements: remote work, a backup location, or loaner laptops.
- Communication: how to reach staff and clients if email is down.
- Decision authority: who declares an emergency and who speaks to clients.
- Vendor contacts: software providers, internet carriers, and your IT partner.
A Realistic Scenario
An eight-person accounting firm loses its server to a hardware failure on March 30, two weeks before a major tax deadline.
Firm A has backups only. The backups are intact, but nobody has tested a full restore. A replacement server takes three days to arrive, and restoring data takes another day. Staff spend most of a week unable to work.
Firm B has backups and a continuity plan. Its plan includes cloud-based recovery that runs critical systems temporarily in a hosted environment. Staff are working remotely by the afternoon. The partners notify a few clients about short delays, and the firm meets its deadlines.
Both firms had backups. Only one had a plan. Downtime affects more than productivity, as we explain in the real cost of IT downtime.
Questions to Ask Your IT Provider
- What exactly is included in our backups, and what isn't?
- How long would a full restore take?
- Is at least one backup protected from ransomware?
- When did we last test a restore?
- Can critical systems run temporarily in the cloud if our office equipment fails?
Build Both
Backups are essential, but they're the foundation, not the whole house. Maise Technology helps firms build complete plans through our business continuity services and disaster recovery services.
Not sure whether your firm has backups only or a real continuity plan? Schedule A 15 Minute Discovery Call and we'll help you find out.
Yes. Every nonprofit that depends on technology to serve people, raise money, or meet reporting requirements needs a disaster recovery plan. It doesn't have to be long or expensive. For most small and mid-sized nonprofits, a few pages that answer "what do we restore, how, and who does it?" will cover the essentials.
Below is a plain-language explanation of what a nonprofit disaster recovery plan includes and a starter checklist you can use this week.
Why Nonprofits Can't Skip This
Nonprofits often assume disaster recovery is for big corporations. In reality, nonprofits may have less room to absorb a disruption. Consider what would happen if you lost:
- Your donor database the week before a year-end giving campaign.
- Program attendance records needed for a grant report.
- Client case notes used to coordinate services.
- Access to email and files after a ransomware attack.
Disasters don't have to be dramatic. A failed hard drive, a deleted folder, or a compromised email account can do serious harm when there's no plan to recover.
Disaster Recovery vs. Business Continuity
These terms are often used together:
- Disaster recovery focuses on restoring technology and data.
- Business continuity focuses on keeping your mission and services going while technology is being restored.
A food pantry might keep serving families with paper sign-in sheets (continuity) while its database is restored from backup (recovery). Both matter.
Two Key Terms, Explained Simply
Recovery time objective (RTO): How long can a system be down before it seriously hurts your work? Your donation platform might need to be back within a day. Your archive of old newsletters could wait a week.
Recovery point objective (RPO): How much recent data could you afford to lose? If you back up nightly, you might lose up to a day's work. If that's too much for your case management system, it needs more frequent backups.
What a Nonprofit Disaster Recovery Plan Includes
- A list of critical systems such as email, donor database, accounting, case management, and shared files.
- Recovery priorities showing what gets restored first.
- Backup details describing what's backed up, how often, and where.
- Contact information for staff, board leaders, IT support, and key vendors.
- Roles explaining who makes decisions and who does the work.
- Manual workarounds for continuing programs without systems.
- A testing schedule to confirm the plan works.
Starter Checklist
Use this list to get from "no plan" to "basic plan" quickly:
- ☐ List every system your organization depends on.
- ☐ Rank each one as critical, important, or can wait.
- ☐ Confirm each critical system is backed up.
- ☐ Confirm cloud services (like Microsoft 365 or Google Workspace) have a backup plan beyond the provider's own recycle bin.
- ☐ Store at least one backup copy where ransomware can't reach it.
- ☐ Restore one file or record to prove backups work.
- ☐ Write down who to call and who decides.
- ☐ Keep a printed copy of the plan and key contacts offsite.
- ☐ Share the plan with your executive director and board chair.
- ☐ Schedule a review once a year.
Frequently Asked Questions
Our files are in the cloud. Isn't that enough?
Not always. Cloud providers keep their systems running, but they may not protect you from accidental deletion, a compromised account, or ransomware that syncs encrypted files. A separate backup adds an important safety net.
How much does disaster recovery cost?
It depends on how many systems you have, how much data you store, and how fast you need things back. Many nonprofits can meet basic needs with modest investments, especially when they prioritize the most important systems first.
Do funders care about this?
Increasingly, yes. Some grant applications and insurance carriers now ask about data protection and continuity planning.
We serve youth or students. Does that change anything?
Organizations that work with young people often hold sensitive information such as attendance, guardian contacts, and permissions. Recovery planning should prioritize protecting and restoring that data. Our IT services for education page discusses related considerations.
Start Small, Start Now
A one-page plan you can actually follow beats a perfect plan that never gets written. Start with the checklist above, then build from there.
Maise Technology helps mission-driven organizations plan for disruptions through our disaster recovery services. Learn more about our work with nonprofits on our IT services for nonprofit organizations page.
Have a question about getting started? Get In Touch.
