You are reading Part 7 of our 12-part Non-Profit Authority Series.
Backup and Business Continuity and Disaster Recovery are related, but they solve different problems. A backup protects copies of data. BCDR addresses the broader question of how the organization restores systems and continues operating after a serious disruption. For a non-profit with 15-30 employees, backup may be sufficient for some systems, while critical operations may justify a more complete BCDR strategy. WTITC offers BCDR separately because recovery requirements, acceptable downtime, and business risk vary from one organization to another.
The 5-Part Backup and Recovery Framework
Non-profit leadership can evaluate recovery readiness using five questions:
- What data is protected?
- How quickly can it be restored?
- What systems are required to operate?
- How much downtime can the organization tolerate?
- Who is responsible for recovery decisions?
Those questions help distinguish ordinary backup from a true continuity strategy.
1. Understand What Backup Actually Does
A backup creates a recoverable copy of data or systems.
Depending on the technology involved, backup may protect:
- Workstation data
- Server data
- Microsoft 365 data
- Shared files
- Application data
- Configuration information
WTITC’s Essentials Security Package includes unified device backup and Datto SaaS Protection where applicable.
Backup is important because accidental deletion, hardware failure, malicious activity, or software problems can create data-loss risk. But leadership should not stop at the statement, “We have backups.”
The better questions are:
- What exactly is being backed up?
- How frequently?
- Where is the protected copy stored?
- Has restoration been tested?
- Who can initiate a restore?
- How long could recovery take?
A backup that has never been validated is not the same as a tested recovery capability.
2. Understand What BCDR Adds
Business Continuity and Disaster Recovery considers the organization’s ability to keep operating after a disruptive event.
That may include:
- Restoring critical servers
- Recovering data
- Prioritizing business functions
- Reducing downtime
- Rebuilding damaged systems
- Establishing temporary operating methods
- Defining who makes recovery decisions
BCDR is broader than backup because it considers time and business impact, not only data availability.
For example, two organizations may have the same backup technology but completely different recovery requirements. One non-profit may be able to work manually for a day. Another may depend on critical systems that cannot be unavailable for several hours without affecting services, donors, reporting, or operations.
A layered ransomware strategy should address both prevention and recovery because even strong security controls cannot guarantee that a cyber incident will never disrupt operations.
That is why recovery belongs in the cybersecurity discussion rather than being treated as a separate afterthought.
3. Define Recovery Time and Recovery Priorities
Leadership should identify which systems matter most before a disruption occurs.
A useful exercise is to classify systems by operational importance.
Critical
The organization cannot reasonably operate without them.
Important
The organization can function temporarily, but delays create meaningful disruption.
Deferrable
The system can remain unavailable for a longer period without immediate operational impact.
Once systems are classified, leadership can ask how quickly each one needs to return.
The purpose is not to create an overly technical document. It is to establish business priorities that IT can support.
For example, a donor-management database may have a different recovery priority than an employee’s local printer.
4. Connect BCDR to Compliance and Risk
Recovery planning can also support regulatory compliance readiness and risk management.
Depending on the organization’s obligations, leadership may need to demonstrate that it has considered:
- Data availability
- Backup practices
- Recovery procedures
- Security controls
- Incident response
- Business continuity
- Documentation
A backup system by itself does not guarantee compliance. However, documented backup and recovery processes can support audit readiness, help demonstrate active management, and reduce compliance-related risk.
Non-profits should also consider grant requirements, insurance conditions, contracts, donor expectations, and applicable regulations when determining recovery needs.
A structured security and compliance review can help leadership identify whether backup, recovery, documentation, and incident-response controls match the organization’s actual risk profile.
5. Understand Why BCDR May Be Optional
WTITC offers Business Continuity and Disaster Recovery as an a la carte service rather than automatically including the same recovery solution for every organization.
That approach recognizes that:
- Some environments are simple.
- Some systems are more critical than others.
- Recovery requirements differ.
- Downtime tolerance varies.
- Costs should reflect actual business needs.
If an organization declines BCDR after it is recommended, leadership should understand the operational risk being accepted.
Knowing which services are outside the standard managed services agreement helps leadership distinguish everyday support from specialized recovery, project, and risk-management services.
This is an important budgeting and governance issue.
Hypothetical Example: A 23-Employee Non-Profit With a Failed Server
Consider a hypothetical Odessa non-profit with 23 employees and 27 managed endpoints.
Its file server fails unexpectedly on a Monday morning.
The organization has backups, but leadership has never discussed how long restoration might take or which functions should be restored first.
A more mature approach would have already established:
- Which systems are critical.
- What data is protected.
- How restoration is initiated.
- How long recovery is expected to take.
- Whether temporary operations are possible.
- Who communicates with staff.
- Whether a BCDR solution is appropriate.
The difference is not simply technical. It is the difference between having data somewhere and having a recovery plan the organization understands.
Backup and BCDR Decision Checklist
Ask:
- What data is currently backed up?
- Is Microsoft 365 data protected?
- Are backups monitored?
- Are restores tested?
- Which systems are business critical?
- How much downtime can we tolerate?
- What would happen if a server failed today?
- What would happen after ransomware?
- Who makes recovery decisions?
- Is BCDR appropriate for our most critical systems?
- What risks are we accepting if we decline BCDR?
- Can we demonstrate backup and recovery controls during an audit or review?
What Should a Non-Profit Budget for Recovery?
BCDR should be evaluated separately from the baseline managed services planning range because recovery requirements differ.
A properly secured managed environment can generally be planned around approximately $125-$175 per endpoint per month, while BCDR may represent an additional investment.
The correct decision depends on the value of the systems being protected and the consequences of downtime.
Trust Signals
WTITC’s approach is designed to make recovery decisions explicit rather than hiding them inside vague service language.
That includes:
- Unified device backup
- Datto SaaS Protection where applicable
- Optional BCDR
- Clear risk acknowledgment
- Monitoring and alerting
- Documentation
- Technology Alignment Manager oversight
The objective is to help leadership understand what protection exists, what is optional, and what risk remains.
Review managed services that combine proactive monitoring, security, documentation, and clear recovery planning for critical business systems.
