The short version
Backup and disaster recovery are two different things that often get sold as one, and the difference is where most of the cost and most of the confusion sit. Backup is keeping copies of your data so you can get it back. Disaster recovery is the plan and the means to get the whole business working again after a serious failure, within a time you can live with. You can have good backups and still be down for days, which is why the question is never just "how much does backup cost" but "how fast does this get me back, and how much data could I lose".
Pricing is almost always monthly, and it tracks three things: the volume of data and the systems you protect, how fast and how complete the recovery needs to be, and whether the restores are tested. A lower quote may cover different retention, recovery capability, licensing or testing. Compare those assumptions directly. This guide walks through what drives the figure, the common pricing models, and what good looks like.
- Backup is getting your data back. Disaster recovery is getting the business running again. The second costs more and matters more.
- Two numbers set the price more than any other: how much data you can afford to lose, and how long you can afford to be down.
- A backup that has never been test restored is a hope, not a safeguard. Tested recovery is the part worth paying for.
The two targets that decide everything: RPO and RTO
Before any price makes sense, you need two numbers. They sound technical, but they are plain business decisions, and they drive the cost more than anything else.
- Recovery point objective (RPO): how much data can you afford to lose? If your backup runs once a night and a failure hits at 4pm, you could lose most of a day's work. If losing an hour is unacceptable, you need to capture changes far more often, which costs more. RPO is the question "how far back is it acceptable to go".
- Recovery time objective (RTO): how long can you afford to be down? Restoring a large dataset from a basic cloud backup can take many hours or longer. If your business can survive a day offline, that may be fine. If every hour down costs you money or clients, you pay for the ability to fail over and keep working in minutes rather than hours.
Most of the difference between a cheap quote and an expensive one comes down to these two targets. Tighter RPO and RTO mean more frequent copies, more capable infrastructure, and faster recovery, and all of that costs more. The way to buy is to set these targets first, based on what the business can tolerate, then price against them.
What drives the cost up or down
Beyond the two targets, a handful of factors move the figure. Two quotes can differ widely and both be fair, because they are protecting different things to different standards.
- Data volume. Most backup is priced by how much you store, so the size of your data is a direct input. It also tends to grow, so what you pay should be expected to rise gradually over time.
- What you are protecting. Backing up files in cloud storage is the cheap end. Protecting on-premises servers, virtual machines, databases, and line of business applications costs more, because there is more to capture and more to restore in the right order.
- Microsoft 365 and other cloud apps. Built-in recycle bins, retention and service resilience can recover some data, but their scope and recovery windows may not meet your needs. Microsoft also offers a separately configured Microsoft 365 Backup service. Compare the native and additional options against your recovery targets instead of assuming hosting alone provides the required backup.
- How fast and how complete the recovery is. Plain backup that restores slowly is cheaper than a setup that can spin your systems back up quickly after a server or site failure. The faster and more complete the recovery, the higher the cost.
- Retention and compliance. How far back you keep copies, and whether you must hold them for a regulator or a contract, affects storage and therefore price. Longer retention costs more.
- Testing and management. Backups that are monitored, alerted on, and periodically test restored cost more than fire and forget storage, and they are the difference between a backup and a recovery you can trust.
The common pricing models
Providers package backup and disaster recovery in a few ways. None is inherently right or wrong. What matters is that the model fits your data and that you can predict the bill as you grow.
| Model | How it works | Best for | Watch for |
|---|---|---|---|
| Per gigabyte or per terabyte | You pay for the volume of data stored, usually monthly | Cloud backup where data volume is the main cost | The bill grows as your data grows; check the rate at higher volumes |
| Per device or per server | A monthly fee for each machine, workstation, or server protected | Firms that want a predictable line per system | Confirm what a "device" includes, and how servers are priced versus desktops |
| Per user (Microsoft 365) | A small monthly fee for each mailbox and account backed up | Protecting Microsoft 365 email, files, and SharePoint | Make sure it covers mail, OneDrive, and SharePoint, not just mailboxes |
| Disaster recovery as a service | Your systems are replicated so you can fail over and keep working fast | Businesses that cannot tolerate long downtime | The capability that justifies a higher price; confirm the recovery time it delivers |
| Bundled into managed IT | Backup and recovery included within a managed support contract | Firms that want one accountable provider and one bill | Confirm it is included and tested, not a token line in the package |
Why bundling with managed IT often makes sense
A backup tool needs an operating service: checking jobs, investigating failures and testing restoration. This can sit within managed IT or a separately scoped backup service. Agree the verification frequency, restore testing, escalation hours and who runs a real recovery. Our guide on how much managed IT should cost explains the wider support model.
Published components and an example
For a concrete starting point, the following are DSC’s published management components, all per month and excluding VAT. They are not a complete disaster recovery quote. Confirm the licence, storage allowance, protected workloads and test scope on the rate card and in the proposal.
- User backup management: £4 per protected user per month. Confirm the exact mailbox and OneDrive coverage and any backup software licensing.
- SharePoint backup management: £50 per tenant per month. Confirm which sites and shared data are protected.
- Server backup management: £40 per protected server per month. Application recovery, dependencies and retention need to be defined.
- Licensing, storage and disaster recovery: backup software licensing passes through at cost. Additional retained backup storage and any standby infrastructure are separate; faster failover needs an explicitly scoped recovery service.
- Example: management for ten protected users and one server is £80 per month before SharePoint management, software licensing, additional storage or disaster recovery infrastructure. This arithmetic illustrates those components only; it is not a standalone service offer or a promised recovery time.
Set RPO and RTO for each critical system, then list users, workloads, retained data and dependencies. Ask for the management, licence, storage, testing and recovery components as separate lines. That turns a broad budget into an offer you can compare.
For the native product’s coverage and limits, read Microsoft’s backup FAQ (opens in new tab). Its SharePoint and OneDrive resilience guidance (opens in new tab) distinguishes service resilience from the recovery choices your organisation configures.
What good looks like
Cost is only meaningful against a standard, so here is what a sound backup and disaster recovery setup includes. Price against this, not against the headline rate.
- Backups follow the 3-2-1 principle. At least three copies of your data, on two different types of media, with one kept off site. It is the long standing rule of thumb for surviving a failure, theft, or fire, and the NCSC sets out its own expectations for backups in 10 Steps to Cyber Security (opens in new tab).
- An off site, immutable copy. A copy held away from your premises, written so it cannot be changed or deleted for a set retention period, to reduce the chance that the same compromise destroys the recovery copies. Test access, retention and restoration; immutability does not prove that a stored copy is clean.
- Restores are tested, not just taken. A backup is only proven when someone has restored from it. Regular test restores are the difference between a backup and a recovery you can rely on.
- Recovery targets are written down and met. Your RPO and RTO are agreed, documented, and demonstrably achievable, not assumed.
- Microsoft 365 is covered. The selected Microsoft 365 recovery service covers the required email, files and SharePoint data with documented retention and tested restores.
- Monitoring and accountability. A named owner checks backup health and handles failures within the agreed service hours, with an escalation and recovery plan.
We are not the cheapest place to buy backup, and we are not trying to be. The view we take is simple: backup is only worth anything at the moment you need to recover, and that is the worst possible time to discover it was never tested. The figure that matters is the cost of getting your business working again, fast, with no nasty surprises. Tested recovery, an off site copy, and someone accountable are not the expensive extras. They are the whole point.
Common questions
How much does business backup cost per month in the UK?
DSC’s published monthly backup management components are £4 per protected user, £40 per server and £50 per SharePoint tenant, excluding VAT. Backup software licensing, additional storage and disaster recovery infrastructure are separate. The final figure depends on workloads, retention, testing and recovery targets.
What is the difference between backup and disaster recovery?
Backup is keeping copies of your data so you can get it back. Disaster recovery is the plan and the means to get the whole business working again after a serious failure, within a time you can tolerate. You can have good backups and still be down for days, because restoring everything in the right order takes time. Disaster recovery costs more because you are paying for fast, complete recovery, not just stored copies. Most businesses need both, and the recovery side is the part that protects you when it matters.
Do I need to back up Microsoft 365 if Microsoft already hosts it?
Review your recovery needs rather than assuming the subscription is enough. Microsoft 365 includes resilience and retention features and also offers a separate Microsoft 365 Backup service. Establish which data is recoverable, for how long and how quickly, then choose and test a backup service that meets those requirements.
What are RPO and RTO, and why do they affect the price?
They are the two targets that drive the cost more than anything else. Recovery point objective (RPO) is how much data you can afford to lose, which sets how often backups run. Recovery time objective (RTO) is how long you can afford to be down, which sets how fast and capable the recovery has to be. Tighter targets mean more frequent copies and more capable infrastructure, both of which cost more. The way to buy is to agree these targets first, based on what the business can tolerate, then price against them.
Is cloud backup cheaper than on site backup?
Cloud backup usually has a lower upfront cost, because there is no hardware to buy, and you pay a predictable monthly fee for the data you store. On-site backup can restore large volumes faster, because the data is local, but you own and maintain the hardware. The strongest approach is rarely one or the other. It follows the 3-2-1 principle, with copies in more than one place and at least one held off site, so a fire, theft, or ransomware cannot take out every copy at once. Which mix is right depends on your recovery time target and your data volume.
How do I know my backups will actually work?
Only by testing them. A backup that has never been restored is a hope, not a safeguard, and the worst time to find out it was never working is the moment you need it. A sound setup includes regular test restores, monitoring that flags a failed backup the day it fails, and someone accountable for acting on it. When you compare providers, ask plainly whether restores are tested and how often. If the answer is vague, you are buying stored copies, not a recovery you can rely on.