A backup copies files, mailboxes, or whole systems on a schedule and keeps earlier versions. Disaster recovery goes further and answers how the business keeps working if a server, an office, or a cloud account is lost. It defines two targets: the recovery time objective, how long you can be down, and the recovery point objective, how much recent data you can afford to lose.
A business can have good backups and still be offline for days if nobody has planned where to restore them or in what order. For a small company the practical questions are simple: which systems must come back first, who does the work, and how long it will take. Answering them before an incident is far easier than working it out during one.
A backup that has never been restored is an assumption, so test restores regularly. Keep at least one copy offsite and one that ransomware cannot alter or delete, and do not assume Microsoft 365 or Google Workspace keeps restorable copies of everything for as long as you need. The 3-2-1 rule, three copies on two types of storage with one offsite, is a sound starting point. We set up and test backups and document the recovery steps.