Your backup strategy should have at least two objectives:

• Your Recovery Point Objective, or RPO.
  • This objective defines how much data you are willing to lose in a disaster.  Average small business RPO is 24 hours, meaning you are willing to lose up to 24 hours worth of data.
• Your Recovery Time Objective, or RTO.
  • This objective defines the longest it can take for your systems to be restored after a disaster.  Average small business RTO is 72 hours, meaning you are willing to wait up to three days to get your computers and systems back up and running after a fire or other disaster.

These objectives allow you to define your requirements for your backup system, which any provider should be able to take and give you a quote on a backup system that meets those requirements.

In addition to these metrics, you should also have local backups that happen several times a day to provide local recovery from corruption.  Corruption can be a user deleting a file by mistake or a virus encrypting it.  We recommend Microsoft Shadow-Copy and Microsoft Server Backup for your local backups.  In an environment with many servers, we recommend Microsoft System Center Data Protection Manager (DPM) for backups.