One Backup Method, No Fallback: The Financial Cost of a Single Point of Recovery

The tolerated pain: one way back, and nothing behind it

Ask a small business how its data is protected and the answer is usually a single thing. "Everything is in OneDrive." "The IT company runs a nightly backup." "We copy the server to an external drive on Fridays." "The accounting software is in the cloud, so it is backed up."

Each of those can be a reasonable part of a backup plan. The problem is when it is the whole plan. If the one method fails, is misconfigured, was quietly switched off, keeps data for too short a period or is reached by the same incident that hit the original data, the business has no second way to recover.

Mellorca has covered related weaknesses: backups that have never been tested, backups nobody monitors and backups kept in the same environment as the data. This article deals with a broader design question: whether recovery depends on a single method, tool, provider or person, with no fallback if that one route fails.

Why businesses rely on one method

• Sync is mistaken for backup. File sync services copy changes, including deletions and encrypted files, to every connected device. They help with availability but are not an independent backup on their own.
• Cloud is assumed to be protected. Software-as-a-service providers protect their platform. Protecting the business's own data from deletion, compromise and misconfiguration is usually still the customer's job.
• One tool feels complete. A backup product reports success every night, so a second method looks like duplication.
• Cost. A second method, provider or copy seems like spending on something that may never be needed.
• One person set it up. The arrangement is understood by a single staff member or contractor, and nobody else has examined it.

How a single method fails

A single backup method can fail in ways that leave no warning until a restore is attempted:

• Shared fate. The incident that destroys the data also reaches the backup, for example ransomware with access to a connected drive, or a compromised administrator account that can delete backups.
• Retention too short. Corruption, deletion or a slow-moving compromise is discovered after the backup's retention window has passed, so every available copy is already affected.
• Coverage gaps. The method protects files but not email, the accounting data file, line-of-business applications or system configuration.
• Tool or provider failure. A licence lapses, an agent stops running after an update, or the provider account is suspended or compromised.
• Restore too slow. The only copy can be restored, but only at a speed that leaves the business down for far longer than it can afford.

The US Cybersecurity and Infrastructure Security Agency's ransomware guidance addresses several of these directly. It recommends offline, encrypted backups of critical data with regular testing of availability and integrity, notes that immutable cloud storage can protect stored data, and suggests using backup solutions from more than one vendor so that a compromise of one provider account does not cause total data loss.

Even good platform backup is still one method

Platform backup services have improved. Microsoft's documentation for Microsoft 365 Backup, for example, describes recovery points every 10 minutes for recent periods, configurable recovery windows from three months to two years, and append-only storage that protects existing restore points from being overwritten. It also states that backup data stays within the Microsoft 365 boundary. That is a strong tool. For a business that wants a fallback, the remaining question is whether anything sits outside that one platform, account and set of administrators.

Operational consequence

When the only method fails, recovery stops being a restore and becomes a rebuild. Systems are reinstalled from scratch, data is reconstructed from emails, paper and customer records, and some information is simply gone. Downtime is measured in weeks rather than hours. Staff are paid while they cannot work, customers cannot be served or invoiced, and management attention goes entirely to recovery.

How the pain becomes money

• Downtime cost: idle payroll and lost contribution margin for every day of the extended outage.
• Reconstruction labour: rebuilding records, transactions and configurations by hand.
• Permanent data loss: history, designs, contracts and customer records that cannot be recreated.
• Emergency spend: specialist data recovery, urgent consulting and replacement equipment at short notice.
• Risk exposure: obligations under POPIA if personal information is lost, and difficulty meeting tax record-keeping requirements.

A transparent way to price the fallback

The value of a second method is the difference between two outcomes when the first one fails. The formula uses your own figures; the example values are illustrative.

Without a fallback: daily operational exposure × rebuild days + reconstruction labour + value of permanently lost data
With a fallback: daily operational exposure × restore days from the second method + re-entry since its last copy

Illustrative example. A Gqeberha accounting practice with 14 staff kept all client files in a cloud file service and relied on its built-in version history as its only protection. A partner's compromised account was used to delete and overwrite a large set of client folders, and the problem was noticed after the version history for some files had expired. Taking its own daily operational exposure of roughly R40,000 in fees and salaries, the practice estimated that rebuilding from email attachments and client resubmissions would take about three weeks. Restoring from an independent second copy would have taken one or two days. The difference was well over half a million rand, against a second-method cost of a few thousand rand a month.

Mellorca's article on not knowing the hourly cost of downtime shows how to calculate the operational exposure figure.

When it becomes commercially urgent

• you can describe your entire backup arrangement in one sentence;
• cloud email and files have no protection other than the provider's own retention or recycle bin;
• one person or contractor is the only one who understands how backups work;
• the same administrator account can delete both the data and the backup;
• you have never estimated how long the business could operate without its main systems.

What better looks like

NIST's contingency planning guide for information systems sets out the discipline behind a resilient approach: assess business impact, decide what must be recovered and how quickly, and design recovery strategies to meet that. For a small business, that usually means:

• At least two independent methods for critical data, using different tools, accounts or providers, so one failure does not remove both.
• One copy that cannot be altered or deleted from the normal network or admin accounts, through offline storage or immutability.
• Retention long enough to cover problems that are discovered late.
• Coverage of everything critical, including cloud email, accounting data and system configuration, not only files.
• Documented restore steps that someone other than the original installer can follow, tested from each method.

Practical steps

1. List your critical data and systems, and how each one is currently protected.
2. Mark anything protected by only one method, or by sync alone.
3. Agree how long the business can be without each system and how much data it can afford to lose.
4. Add a second, independent method for the most critical items first, with separate credentials.
5. Set retention to cover late-discovered problems.
6. Test a restore from each method and record how long it took.

Mellorca's digital infrastructure work includes designing backup and recovery that does not depend on a single route.

Bottom line

A single backup method is a single point of failure in the one plan meant to protect against failure. The commercial value at stake is the difference between a short restore and a weeks-long rebuild, plus whatever data could never be recovered. A second, independent method usually costs a small fraction of that difference.

Sources and further reading

• SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems - CSRC (last verified 10 October 2026)
• Overview of Microsoft 365 Backup (last verified 10 October 2026)

Related Mellorca reading

• When One Employee Knows How Everything Works
• Meetings That Decide Nothing: The Payroll Cost of Meeting Overload
• Cloud Costs Rising Every Month Without an Explanation