Short answer: Most Brevard offices that say “we have a backup” are covered for one kind of failure: a dead server. The gaps sit everywhere else, in Microsoft 365 mail and OneDrive files, security camera footage, the phone system’s call routing, and the passwords you need to start a restore. A plan that holds up has four parts: a list of every place the business keeps data, an off-site copy a Space Coast storm can’t reach, a restore you’ve actually tested, and a written order for what comes back first.
A backup gets tested one of two ways. Either you pick a quiet afternoon to try a restore, or you find out the morning after a hurricane, a ransomware note or a dead drive, when there’s no choice left. This post is for the quiet afternoon. It walks backward through a data backup and disaster recovery plan for a Brevard office: start with what you’d restore first, then make sure the backup actually holds those things.
The first morning back: what to restore, in order
Picture the first morning back after a storm, a ransomware note or a dead server. Bring back what lets customers reach you and lets staff work, then the archive.
| Order | System | Why it’s here |
|---|---|---|
| 1 | Phones and call routing | Customers call before they email. On a hosted system this can be as small as turning the storm greeting off. On an on-site PBX it may mean undoing the trunk forwarding. |
| 2 | Internet and firewall | Everything below depends on it. |
| 3 | Email and Microsoft 365 sign-in | Staff can coordinate, and customers can reach you in writing. |
| 4 | Accounting, scheduling or practice software | Billing, appointments and orders. |
| 5 | Shared files in use this month | Restore the current working set first. |
| 6 | Archives and everything else | These can wait days without stopping the business. |
Write your own version now, with a name next to each line. How long each system can stay down, and how much recent data you can afford to lose, are the recovery targets (RTO and RPO) on our cloud backup and disaster recovery page. Decide those numbers before you pick a backup product, not after.
Six places a typical Brevard office backup doesn’t reach
The server or NAS backup is usually the part that’s handled. Someone set it up, it sends a nightly email, and it covers the shared drive. The trouble is the data that never lived on that server.
| Data | Where it lives | What goes wrong | What covers it |
|---|---|---|---|
| Email, OneDrive and SharePoint files | Microsoft 365 | Exchange Online keeps deleted mail recoverable for 14 days by default, and the setting tops out at 30. Without a separate backup or a retention policy, mail deleted by a compromised account and noticed in week five is gone. | A separate Microsoft 365 backup that keeps versions for as long as you set. |
| Security camera footage | The recorder (NVR) in a closet or under a desk | If the recorder is stolen, flooded or damaged, the footage of what happened goes with it. | Cloud copies of the key cameras, or a recorder mounted high and away from the door. See our security camera systems. |
| Phone system settings | The PBX, or the hosted provider’s portal | Call flows, ring groups, after-hours rules and greetings get rebuilt from memory after a failure. | A configuration export from an on-site PBX, or a written call-flow map for a hosted system, stored with the other backups. |
| Accounting or practice software | One workstation, or the vendor’s cloud | The database sits on “the front desk PC,” or nobody has ever exported a copy from the vendor. | Add the database to the server backup, or get the vendor’s backup and export process in writing. |
| Firewall, switch and Wi-Fi settings | The devices themselves | A replacement firewall comes up blank, and the VPN, port forwards and VLANs have to be rebuilt. | A saved configuration after every change. |
| Passwords, MFA recovery codes, domain login | Someone’s head or someone’s phone | The backup exists, but nobody can sign in to start the restore. | A password manager with a named emergency-access person, holding the Microsoft admin and domain registrar logins. |
The last row decides how fast all the others come back. A restore can stall on a missing admin password just as surely as on a failed backup job. If the one person who knows the Microsoft 365 admin login is evacuated to Georgia with a dead phone, the best backup in the county sits there unused.
The off-site copy belongs outside Florida
The 3-2-1 rule is the standard: three copies, on two kinds of storage, with one off-site. Our cloud page walks through it. On the coast, the part people get wrong is how far “off-site” really is. A second drive in the same building shares the flood. A copy at the owner’s house in Viera shares the storm. A cloud copy is only as far away as the data center region it’s stored in, and most backup services let you choose that region.
- Keep one copy in a cloud region outside Florida. A storm that takes out a Rockledge office is very unlikely to reach a data center several states away.
- Make that copy immutable or offline, so it can’t be deleted or encrypted with the same admin login as everything else. CISA’s #StopRansomware Guide calls for offline, encrypted backups of critical data and regular tests of whether they can actually be restored.
- Do the upload math before you sign up. Two terabytes over a 35 Mbps upload is more than five days of nonstop transfer for the first full copy. If that line also carries your VoIP calls, run the seed overnight or ship a drive to the provider. Our post on business internet redundancy covers what to do when that line goes down.
Test a restore twice a year, in 30 minutes
A backup report that says “success” means the job ran. It doesn’t mean you can get the data back. Have someone other than the person who set up the backup work through this:
The restore test
- Pick a file in a shared folder that someone changed about a month ago.
- Restore the version from 30 days back to a different folder. Never restore over the original.
- Open it and check it’s the right version, not just a file with the right name.
- Restore one email deleted at least two weeks ago, from the Microsoft 365 backup rather than the Deleted Items folder.
- Time each step and write the numbers down. That’s your real recovery time for a small restore.
- If anything failed, fix it this week, not at the next test.
Run it again after any change to the server, the backup software or your Microsoft 365 setup. Testing restores on a schedule and keeping the results is part of what managed IT services in Brevard should include, if you’d rather hand it off.
A storm-season backup calendar for Brevard
The Atlantic hurricane season runs from June 1 to November 30, and the National Hurricane Center puts the peak on September 10, with most activity between mid-August and mid-October. The dates that matter are the ones before that stretch, not the week a storm shows up in the forecast.
| When | What to do |
|---|---|
| April or May | Run the restore test above. Confirm the off-site copy is current and stored outside Florida. Update the emergency contact list and your restore order. |
| Early August | Repeat the restore test before the peak. Check the UPS batteries on the server, firewall and phone equipment. |
| Brevard is inside a storm’s forecast cone | Confirm the last off-site backup finished. Export the phone system and firewall settings. Record a storm greeting and set calls to forward to cell phones. |
| The day before landfall or evacuation | Run one more backup. Shut servers down cleanly, unplug them, and move anything sitting on the closet floor up onto a shelf. |
| After the storm | Bring systems back in your restore order. Check that the backup jobs restart and finish before you call it done. |
| December | Write down what broke this season and fix it while everyone still remembers. |
Short answers to the questions owners ask
| Question | Short answer |
|---|---|
| Doesn’t Microsoft 365 already back up our email? | Not the way most people assume. Deleted mail stays recoverable for 14 days by default, and an admin can raise that to 30. Retention policies can hold mail longer, but only if someone has set one up. Without one, mail that a compromised account deleted and nobody noticed until next month is usually gone. A separate backup keeps versions for as long as you set. |
| Is OneDrive or Dropbox a backup? | No, it’s sync. When a file is deleted or encrypted on a laptop, the sync copies that change to the cloud. Version history and the recycle bin help for a limited time, so check how long your plan keeps them, but don’t count sync as your off-site copy. |
| Is an external hard drive enough for a small office? | As one of your three copies, yes. As the only copy, no. It sits in the same building, it’s usually plugged in all the time where ransomware can reach it, and nobody checks it until the day it’s needed. |
| How often should we test our backups? | At least twice a year: once before hurricane season and once in early August before the peak, plus after any big change to the server or software. The restore test earlier in this post takes about half an hour. |
| What should we do with the server when a hurricane is coming? | Confirm the last off-site backup finished, shut the server down cleanly, unplug it, and get it off the floor. Don’t count on the battery backup through a long outage. It’s there to give you time for a clean shutdown, not to keep the server running for days. |
| We’re a five-person office. Do we really need all this? | The data list and the restore test, yes. Together they take an afternoon. The rest depends on how long you can afford to be down. For a small office that can be as simple as one cloud backup service and one Microsoft 365 backup. |
Not sure what your backup actually covers? Ask for a free cloud and backup assessment. We’ll check what’s included, where the copies live, and when a restore was last tested, then tell you what’s missing.
Talk to BBTS or call 321-636-9000.
