Who provides data backup and disaster recovery for small businesses in Dallas?
Cross River Tech does. I am Anthony Omini, and I set up backup and disaster recovery for small businesses in Dallas: files, servers, laptops, Microsoft 365 or Google Workspace and business databases, with an offsite copy, a copy ransomware cannot delete, restores I actually test and a written recovery plan. It is included in my managed IT plan, or I can review your current backup by the hour.
Answered by Anthony Omini, Cross River Tech, Dallas
Key takeaways
- A good backup covers every place work lives: shared folders, servers, the NAS, laptops, Microsoft 365 or Google Workspace and business databases.
- Keep three copies on two kinds of storage with one offsite, and make one copy immutable or offline so ransomware and a stolen admin account cannot delete it.
- Microsoft 365 and Google Workspace keep their services running, but restoring last month's version of your data needs a backup decision of its own.
- A green 'backup succeeded' message proves the job ran; only a tested restore proves you can work from the copy.
- Managed backup and disaster recovery are part of my managed IT plan; a one-time review is billed hourly at $100 remote or $150 onsite.
Who provides backup and disaster recovery for small businesses in Dallas?
Cross River Tech provides data backup and disaster recovery for small businesses in Dallas, with onsite service across Dallas–Fort Worth and remote support throughout Texas. A good setup should protect business files, email, cloud documents, servers, laptops, and application databases. It should include separate backup copies, offsite storage, protection against ransomware, a schedule matched to your work, tested restores, and a written recovery plan. I include managed backup and disaster recovery in my managed IT plan. I can also review or set up backups as a one-time hourly project.
When you call Cross River Tech, I am your direct contact. I answer the phone, plan the work, and come onsite myself. My team handles day-to-day monitoring and updates. That keeps backup decisions connected to the person responsible for helping your business recover.
I bring over 15 years of IT experience across many industries and global organizations. For a small business, that experience matters when deciding which systems need to come back first and which dependencies could hold up recovery.
A law firm may need its document system before anything else. A dental or medical practice may depend on its practice software and images. An insurance agency may need access to client records, while an architecture or interior design firm may need large project files and the applications that open them.
My cybersecurity and backup work starts with those business needs. Buying storage comes later.
If you cannot explain what your current backup protects, call or text (214) 612-7080. Tell me which applications keep your business running and what you currently use for backup. I can review the gaps and explain the next step.
What should a small business back up?
Start with a list of where work actually lives. Include equipment in the office, laptops outside it, cloud accounts, and applications maintained by outside vendors. A backup that covers the server can still miss the files someone saves on a laptop desktop.
Business files and shared folders. Include client documents, contracts, proposals, financial records, project drawings, templates, and other work that would be difficult to recreate. Identify who owns each folder and who should be allowed to recover it.
Servers. File backups protect documents, but rebuilding a failed server may also require its operating system, applications, configuration, and permissions. A system image—a backup designed to help rebuild the machine—can support that process. The recovery plan must still account for replacement hardware and application licensing.
Network-attached storage. A NAS is a storage device that shares files over your network. It needs its own backup. Redundant drives can help a NAS survive a drive failure, but they do not undo deleted folders, stolen equipment, or ransomware. Snapshots stored on that same device should not be its only protection.
Laptops. Decide whether important files must be saved in approved shared locations or backed up directly from each laptop. Then verify that the arrangement works when people travel or work remotely. A backup schedule cannot protect a laptop that stays disconnected from its backup service.
Line-of-business databases. Accounting, practice management, agency management, and other business applications may store records in databases. Copying an open database file may not produce a usable backup. The backup method should follow the application vendor's supported process and capture related attachments, images, and configuration.
Recovery information. Keep software installation details, vendor contacts, network settings, license information, and instructions for obtaining recovery credentials. Store sensitive information securely. A backup is less useful if the password needed to restore it exists only on the failed computer.
For hosted business software, request a clear explanation of what the vendor can restore, how restoration is requested, and what remains your responsibility. An export may help preserve records, but it may not rebuild the working application.
Where should the backup copies live? The 3-2-1 rule
The 3-2-1 rule means keeping three copies of important data: the working copy and two backup copies. Those copies should use two different storage media or technologies, with one copy offsite. Government ransomware guidance recommends the same idea for one reason: recovery copies have to be separated from the systems they protect.
For a Dallas office with a file server, that could mean the live files on the server, a backup on a separate local backup device, and another backup in cloud storage. Each copy has a purpose.
A local backup can make routine restores more convenient. It avoids downloading the entire recovery set over the internet. An offsite copy protects against an incident that affects the office itself, such as theft, fire, or damage to equipment.
Offsite can mean cloud storage or properly handled removable media stored elsewhere. Cloud storage needs secure administration, suitable retention, and a workable download or recovery process. Removable media needs a documented rotation and a person responsible for disconnecting and storing it.
Location alone is not enough. A backup device beside the server shares the building's risks. A cloud backup controlled by the same compromised administrator account may share an access risk. Separate copies should have meaningful separation in both storage and administration.
For ransomware, add immutable or offline protection. Immutable means a backup cannot be changed or deleted during its enforced protection period. Offline means the copy is disconnected from the systems an attacker could reach.
Neither label should be accepted without checking the settings. Ask whether an administrator can shorten the protection period, delete the storage account, or remove the recovery copies. Confirm how emergency access works without weakening protection.
CISA recommends offline, encrypted backups and regular recovery testing. I treat that as a practical design requirement: the business needs a recoverable copy even when its ordinary network cannot be trusted.
Are Microsoft 365 and Google Workspace backed up already?
Microsoft and Google operate cloud services with their own availability and recovery protections. That does not mean your subscription automatically includes an independently configured backup of everything your business might need to restore.
The distinction is between keeping a service operating and recovering your business's earlier data.
Microsoft explains that its disaster recovery copies maintain the current state of content. Its separate Microsoft 365 Backup offering provides recovery to earlier protected states. Version history and legal holds also have different purposes and limitations.
Google Vault is designed for information governance and discovery. It should not be assumed to provide the same recovery workflow as a dedicated backup service. Google also warns that deleting a user can remove data retained through Vault. Account handling therefore belongs in the protection plan.
For your Microsoft 365 and Google Workspace environment, identify the mailboxes, shared mailboxes, individual file storage, shared drives, and collaboration locations that matter. Check the backup product's supported workloads individually. A product that protects email may leave another service outside its scope.
Then check recovery behavior. Can you restore a deleted message, a folder, or an entire affected account? Can you recover into another location without overwriting current work? What happens to protected data when an employee leaves?
Synchronization also needs a separate explanation. Sync keeps locations aligned. It can carry an accidental deletion or unwanted change to other devices. Historical recovery depends on the versioning, retention, and backup controls actually configured.
If someone has already deleted important material, preserve the available recovery options before changing accounts or retention settings. My guide to what can be recovered after someone deletes files explains the decisions involved.
How often to back up, how long to keep it and how fast to recover
I set backup schedules by asking what your business could realistically recreate. A folder of reference material and a database receiving transactions throughout the workday do not need the same schedule.
Recovery point objective, or RPO, means how much recent work you can afford to lose. If the last usable backup predates the afternoon's work, that work may need to be recreated. The backup schedule should fit the loss your business can tolerate.
Recovery time objective, or RTO, means how long you can afford to wait before a system is usable again. Restoring documents and rebuilding an application server are different jobs. The target must account for equipment, internet access, software installation, database recovery, and checking that the application works.
These are planning targets, not promises. A recovery estimate should come from a tested method and known dependencies.
For frequently changing records, consider backups during the workday. For less active material, a daily schedule may fit the business need. Laptops need schedules that accommodate their availability. Backup jobs should also be checked for completion: a frequent schedule has little value when jobs repeatedly fail.
Retention means how long older recovery points remain available. Keep enough history to address problems discovered later, such as an overwritten project or unnoticed corruption. Keeping only the newest backup can remove the last good copy before anyone recognizes the problem.
A useful policy distinguishes recent recovery points from longer-term records. Consider frequent recent copies for operational recovery and selected older copies for problems discovered later. Do not keep every copy indefinitely without a reason; storage costs, sensitive information, and disposal obligations still matter.
For legal, medical, dental, or insurance records, confirm applicable retention requirements with the appropriate adviser. A backup retention setting does not establish a records policy by itself.
Write down the approved schedule, retention, and recovery targets for each important system. Revisit them when applications change, storage grows, or the business starts depending more heavily on a particular service.
How do you test a restore and write a recovery plan?
A successful backup notification proves that a job reported success. A restore test establishes whether the protected data can support useful work.
Start by restoring a representative file to a separate location. Open it with the application people actually use. Check that its contents are readable and that the selected recovery point contains the expected work.
For databases, go further. Restore using the application vendor's supported procedure in an isolated test environment. Open the application, examine representative records, and check related attachments. Avoid connecting a test copy to live integrations that could send messages or change production data.
For a server recovery test, verify the rebuild process and its dependencies. Record what equipment, credentials, installation files, and outside assistance were needed. Measure the recovery process through application validation, rather than stopping when a file finishes downloading.
Schedule tests deliberately and repeat them after meaningful changes. Moving a database, replacing a server, changing permissions, or adopting another cloud service can invalidate an older test.
The written recovery plan should explain:
- Who can declare an incident and authorize recovery.
- How to reach me, application vendors, and other essential contacts.
- Where protected copies and recovery instructions are located.
- How authorized people obtain credentials and encryption keys.
- Which systems return first and what each depends on.
- How recovered systems are checked before normal work resumes.
- Who records remaining problems and communicates business status.
Keep a securely accessible copy outside the systems it describes. A plan stored only on the unavailable server creates another obstacle.
During suspected ransomware, restoring immediately to a compromised network can expose recovered systems again. Containment and a clean recovery environment belong in the process. If an incident is underway, read ransomware: what to do in the first day and call for help before reconnecting backup devices.
What do cyber insurers ask about backups?
Your insurer's actual questionnaire controls what you need to answer. Treat every answer as a statement about the current setup, supported by evidence.
Backup questions may cover what is protected, backup frequency, offsite storage, immutable or offline copies, encryption, administrative access, and restoration testing. Read the wording carefully. A question about all critical systems cannot be answered by showing that a shared folder has a backup.
Useful supporting material includes the protected-system inventory, retention settings, successful job records, access controls, and restore-test results. Record the scope and outcome of each test. Recovering a document does not establish that the business database can be rebuilt.
Pay attention to credentials. If an attacker gains an ordinary network administrator account, could that account also delete the backups? Document separate administration and multifactor authentication—an additional identity check beyond a password—where configured.
Do not mark a control as present because the software supports it. Confirm that the feature is enabled and covers the systems named in the questionnaire.
If your cyber-insurance questionnaire came back short, I can review the technical gaps. Your broker or insurer should resolve questions about policy wording, acceptable evidence, and coverage.
What does backup and disaster recovery cost?
Backup costs include licensing, storage, and management. Compare all of them before deciding that a low software subscription represents the complete cost.
Licensing depends on what needs protection: users, devices, servers, cloud accounts, or application workloads. Storage depends on protected data, change frequency, retention, and the copies required. Management includes configuration, checking failures, maintaining access, testing restores, and keeping the recovery plan current.
| Cost or service | What affects the scope | How I handle pricing |
|---|---|---|
| Backup licensing and storage | Protected systems, data volume, retention, and recovery features | I establish the requirements before quoting |
| Managed backup and disaster recovery | Ongoing protection as part of managed IT | Included in my managed IT plan, quoted per user or per device after a short conversation |
| One-time remote setup or review | Existing configuration, required changes, and documentation | $100/hr during business hours; $150/hr after hours, weekends, and holidays |
| One-time onsite setup or review | Equipment access, local storage, and recovery work | $150/hr during business hours; $225/hr after hours, weekends, and holidays |
Hourly support has a one-hour minimum and is billed by the hour. Business hours are Monday through Friday, 8 AM–5 PM Central. A one-time project does not automatically provide ongoing monitoring; identify who will handle that after the work is complete.
My managed IT plan is month-to-month, cancel anytime. Alongside managed backup and disaster recovery, it includes operating system and application updates, antivirus and email security, network management, and Microsoft 365 or Google Workspace administration. It includes unlimited remote support and onsite visits at no extra charge when remote support cannot fix the issue.
I quote managed IT per user or per device after a short conversation. The useful comparison is the protection and ongoing responsibility included in the proposal, alongside the monthly cost.
Five questions that show whether your backup works
Ask these questions before approving another renewal or replacing equipment. Request evidence with each answer.
What is protected, and what is excluded? Look for a current inventory covering cloud accounts, servers, NAS devices, laptops, and application databases. Compare it with the systems people use. Newly added equipment and departed employees' accounts deserve particular attention.
Where are the copies, and what survives an office-wide incident? Identify the actual storage destinations. Confirm which copy is offsite and how it can be reached if the office network is unavailable.
Could a compromised account delete every usable copy? Review immutable retention, offline storage, and administrative access. “It is in the cloud” does not answer who can delete it.
When was a meaningful restore completed? Ask what was restored, whether it opened successfully, and what failed during testing. A database-dependent business needs evidence beyond a recovered document.
How much work could be lost, and what must happen before operations resume? Compare the latest usable recovery point with the agreed schedule. Review the recovery sequence and any untested dependencies.
Call when an answer is missing, a backup repeatedly fails, your application changes, or an insurer asks for evidence you cannot produce. You do not need to wait for data loss.
I provide onsite service across Dallas–Fort Worth by appointment and remote support anywhere in Texas. Same-day onsite visits are often possible. Remote support is available 24/7/365, including US holidays; after-hours rates apply.
Call or text (214) 612-7080, or contact me with a short description of your systems and current backup. I can help you establish what is recoverable, what needs attention, and whether an hourly project or managed IT plan fits your business.
Questions people ask
Who provides small business backup and disaster recovery in Dallas?
Cross River Tech provides backup and disaster recovery for small businesses in Dallas, with onsite service across Dallas–Fort Worth by appointment and remote support throughout Texas. I am Anthony Omini, the owner and your direct contact. Managed backup and disaster recovery is included in my managed IT plan. One-time backup setup and review are also available through hourly IT support.
Does Microsoft 365 or Google Workspace automatically back up everything?
A cloud subscription should not be assumed to include a complete business backup. Microsoft 365 and Google Workspace have recovery, retention, and availability features, but their coverage and recovery methods vary. Microsoft also offers a separate backup product. Check which workloads are protected, how long recovery points remain available, and whether you can restore the information your business needs after deletion or compromise.
Is a NAS or an external drive enough for business backup?
A NAS or external drive can be part of a backup setup, but its location, connectivity, and protection matter. Copies kept beside the original equipment can share the same physical risks. Connected storage may also be reachable during an attack. A business backup plan should include separate copies, offsite protection, and an immutable or offline recovery copy appropriate to the systems being protected.
How often should a small business back up its data?
Backup frequency should reflect how much recent work the business can afford to lose. Frequently changing application databases may need protection during the workday. Less active files may fit a daily schedule. Set the schedule for each workload, verify that jobs finish, and retain older recovery points for problems discovered later. Restore testing should confirm that the chosen method produces usable data.
Can I hire Cross River Tech for a backup review without managed IT?
Yes. I offer one-time backup reviews and setup through hourly IT support without a contract. During business hours, remote work is $100/hr and onsite work is $150/hr. After hours, weekends, and holidays, rates are $150/hr remote and $225/hr onsite. A one-hour minimum applies, with billing by the hour. The review scope should identify protected systems, recovery gaps, and ongoing responsibilities.
Sources and further reading
Market price ranges in this article are my own observation of quotes in the Dallas market, not a published survey. Where I state a rule or a standard, the source is linked above.
