On This Page
Key Takeaway: Backup is a component of business continuity. It is not a substitute for it. The difference shows up when something goes wrong and the client discovers that having a backup is not the same as being able to restore.
KNP was a 158-year-old logistics company in Northamptonshire, England. When hackers from the Akira ransomware gang guessed an employee’s weak password, they encrypted the company’s data and locked its internal systems. KNP paid the ransom. The attackers never restored access. The company entered administration and ceased trading. Nearly 700 people lost their jobs.
KNP had IT compliance with industry standards. They had cyber insurance. They reportedly had backups. None of it mattered because they had no tested business continuity plan. They could not resume operations. The economics of recovery simply did not work.
This is not an isolated case. It is the predictable result of a mistake most business owners make: treating backup as a synonym for business continuity. They are not the same thing. And the gap between them is where companies die.
In this article
- What Backup Actually Is
- What Business Continuity Actually Is
- The Gap Is Not Theoretical
- Why Backups Fail When You Need Them Most
- What a Competent IT Provider Does
- Questions to Ask Your IT Provider
- The Bottom Line
- Frequently Asked Questions
What Backup Actually Is
Backup is a copy of your data. That is it. A snapshot stored on a disk, in the cloud, or on a tape. It is a necessary component of any IT strategy, but it is only one component.
Think of backup like a spare tire in your trunk. Having one is better than not having one. But if you do not know how to change it, if the spare is flat, or if you are stranded on a highway with no shoulder, the spare tire alone does not get you home.
According to At-Bay’s “Backup Breakdown” report (October 2023), 92% of businesses invest in backups, yet 31% fail to restore data from them during a ransomware attack. The backup exists. The recovery does not work.
What Business Continuity Actually Is
Business continuity is the strategy that keeps your company operating during and after a disruption. It encompasses backup, but it also includes:
- Recovery Time Objective (RTO): How long can you afford to be offline?
- Recovery Point Objective (RPO): How much data can you afford to lose?
- Failover systems: Can your operations run from a secondary location or cloud environment while primary systems are restored?
- Communication plans: Who notifies customers, vendors, and employees when systems go down?
- Documented procedures: Does your team know exactly what to do, in what order, when disaster strikes?
- Regular testing: Have you actually verified that your backups restore successfully and your failover works?
As Datto puts it: “Backup is the process of creating copies of your data, systems and configurations so you can recover them if they are lost, deleted or damaged. Business continuity is the strategy and planning that ensures your business can continue operating during and after an unexpected event.”
Backup is a noun. Business continuity is a practice.
The Gap Is Not Theoretical
Having a backup and being able to run your business are two different questions. The At-Bay numbers above show how often the first answer is yes and the second is no. KNP is what that looks like when the restore never happens: the data existed on paper, the operation did not come back, and the company did not survive.
Why Backups Fail When You Need Them Most
There are predictable reasons backups do not save companies during real incidents:
1. Backups are not tested. A backup that has never been restored is an assumption, not a plan. Many organizations never verify their backups at all. You do not know if your backup works until you try to restore it. By then, it may be too late.
2. Ransomware encrypts backups too. Modern ransomware does not just target production systems. It actively seeks out and encrypts backup repositories. If your backups are on the same network as your production data, they are part of the attack surface.
3. Recovery takes longer than you think. Even when backups are intact, restoring a full environment takes time. Hours. Days. Weeks. During that time, your business is not operating. Your customers are calling your competitors. Your employees are sitting idle. Your revenue is zero. Downtime is expensive, and it is expensive on the day you can least afford it. Ask your provider to show you your real hourly cost of being offline rather than trusting an industry average.
4. You are missing critical systems. Many businesses back up file servers and email but forget about line-of-business applications, phone systems, access control, and specialized databases. When you restore from backup, you discover that the application that runs your entire operation was never included in the backup scope.
What a Competent IT Provider Does
If your IT provider tells you that you are “backed up” and leaves it at that, they are doing half the job. Here is what real business continuity looks like from a competent provider:
They define your RTO and RPO. Every system in your business has a different tolerance for downtime and data loss. Your email system might tolerate four hours of downtime. Your order processing system might tolerate fifteen minutes. A competent provider maps every critical system to specific recovery objectives and builds the infrastructure to meet them.
They test recovery regularly. Not annually. Quarterly at minimum. They restore backups to an isolated environment and verify that systems actually boot, applications actually run, and data is actually intact. They document the results. They share them with you.
They maintain offline and offsite backups. Backups that are air-gapped or stored in immutable cloud storage cannot be encrypted by ransomware that has compromised your network. This is not optional in 2026. It is the baseline.
They document the recovery plan. Every step. Every system. Every dependency. In writing. Stored in a location that is accessible even when your primary systems are down. If your IT provider cannot hand you a printed recovery plan, you do not have one.
They conduct tabletop exercises. A tabletop exercise walks through a disaster scenario step by step. What happens first? Who does what? Who calls the customers? Who contacts the insurance carrier? These exercises reveal gaps in the plan before a real disaster exposes them.
Questions to Ask Your IT Provider
If you are evaluating your current provider or shopping for a new one, ask these questions directly:
- “What is my Recovery Time Objective for each critical system, and what infrastructure is in place to meet it?”
- “When was the last time you performed a full recovery test? Can I see the results?”
- “Are my backups stored offline or in immutable storage that ransomware cannot encrypt?”
- “Do you have a documented business continuity and disaster recovery plan for my company? Can I have a copy?”
- “Which of my systems are NOT included in the backup scope, and what is the plan for those?”
- “How long would it take to restore my full environment from backup, and what would my operations look like during that time?”
- “When did we last conduct a tabletop exercise for a ransomware scenario?”
If your provider cannot answer these questions clearly and specifically, you have a backup. You do not have business continuity.
The Bottom Line
KNP had been in business since 1865. They survived two world wars, the Great Depression, and a global pandemic. They did not survive a single guessed password because they had no operational resilience beyond a backup copy.
Backup is necessary. It is not sufficient. Business continuity is the difference between a bad week and a permanent closure. Ask your provider the hard questions now, while you still have time to fix the answers.
Frequently Asked Questions
What is the difference between backup and business continuity?
Backup is a copy of your data. Business continuity is the complete strategy that keeps your company operating during and after a disruption. Backup is one component of business continuity, but it does not include failover systems, recovery procedures, communication plans, or regular testing.
How often should backups be tested for recovery?
At minimum, quarterly. A backup that has never been restored is an assumption, not a guarantee. Regular recovery testing verifies that backups are intact, systems actually boot, and data is usable.
Can ransomware encrypt my backups?
Yes. Modern ransomware actively targets backup repositories. If your backups are on the same network as your production data, they are vulnerable. Competent providers maintain offline or immutable cloud backups that cannot be encrypted by network-based attacks.
What are RTO and RPO?
Recovery Time Objective (RTO) is the maximum time your business can afford to be offline. Recovery Point Objective (RPO) is the maximum amount of data you can afford to lose. These metrics should be defined for every critical system in your business.
How many businesses fail after a disaster?
Nobody has a single reliable number for this, and I would not trust one that claims to. What the record does show is that backups often fail at restore time: At-Bay found that 31% of businesses could not restore from their backups after a ransomware attack. The practical answer is to define your RTO and RPO, test restores on a schedule, and have a written plan for running the business while systems come back.
About the Author
Brent Lacy has spent over 20 years in the IT services industry, building and advising MSPs across the country. He is the author of Rewired MSP: Mastery, Scalability & Performance, vCIO Rewired: Virtually Conquering IT Obstacles, and Near Miss: Preventable IT Failures Threatening Your Business Security. His work focuses on operational excellence, trust-based client relationships, and the business discipline that separates surviving MSPs from thriving ones.
Related Articles
- Is Your IT Provider Too Busy to Monitor and Document?
- Is Your IT Provider Not Taking Security Seriously?
- Is Your IT Provider Giving Users Too Many Rights?
This article is part of the MSP Cybersecurity Hub, everything Rewired MSP has published on building a security-first practice.
This article is part of the MSP Cybersecurity hub.
