“We have backups” is one of the most dangerous sentences in business technology, because it is usually where the conversation stops. The questions that matter come next: backups of what, tested when, restorable how fast and what does the practice do while the restore is running?
Backup is a copy; continuity is a plan
Backup answers the question “is our data safe?”. Business continuity answers “can we keep working?”, which involves people, communications, alternative ways of accessing systems and a clear order of priorities, not just data.
A practice can have flawless backups and still lose a week of production because nobody planned how sixty people would actually work while systems were rebuilt.
Two numbers every director should know
Recovery Time Objective (RTO) is how long you can afford to be down. Recovery Point Objective (RPO) is how much recent work you can afford to lose. Neither is an IT decision, they are business decisions with cost implications and IT builds to whatever targets leadership sets.
For deadline-driven AEC work, the honest answers are often more demanding than the current setup can deliver. Better to discover that in a planning meeting than mid-incident.
Test like you mean it
An untested backup is a hope, not a control. Restores should be tested regularly and realistically, including full-scale scenarios such as recovering a project server or a Microsoft 365 site, timed against your stated RTO.
Layered protection matters too: at least one backup copy should be off-site and isolated from your production credentials, so an attacker who compromises the network cannot also destroy the backups.
WIT builds and tests layered backup and continuity arrangements as standard for managed clients, because a bad day should never become a lost project.