Data backup for SMBs has come a long way from the Sisyphean task of pushing a boulder made of floppy copies, CD-ROM file dumps, and tape drives with a 50% failure rate uphill. Today, error-free remote backups to the cloud are common. But for MSPs, the conversation has evolved. They have to help their clients think beyond backup and disaster recovery to the bigger picture of business continuity.
4 MSPs on BCDR
Business continuity and disaster recovery (BCDR) can have some nuanced differences depending on how your MSP looks to service clients. Here are a few examples:
- Mike Bloomfield, CEO of Staten Island, NY-based Tekie Geek, described a business continuity plan (BCP) as “going beyond responding to a disaster to ensuring smooth operations amidst disruptions.”
- The distinction matters for Michael Goldstein, market president-Southeast Florida for Fort Myers, FL-based Entech. Disaster recovery, incident response, and business continuity “come down to your tolerance for downtime, and how much you can pay,” he said. Clients who understand the cost of downtime are more receptive to business continuity planning. For example, law firms lose billable hours if attorneys can’t work. “That softened the blow when I gave them the ‘Ferrari’ or the ‘Beamer’ pricing,” he added.
- Dawn Sizer, CEO of Mechanicsburg, PA-based 3rd Element Consulting, explained that a BCP identifies and considers “every risk a business has, not just data or cyber incidents.” This includes loss of a key employee or even an entire building. The customer must accept, transfer, or mitigate each identified risk.
- Bryan Herbstritt, president of Salt Lake City-based FidelITech Solutions, works from a business-first perspective. “I had an MBA, and that helped convince prospects I had a full understanding of their business needs,” he said. This often makes his BCDR conversations more effective.
What Should MSPs Include in a Business Continuity Plan?
While every client environment is different, MSPs can follow a consistent framework when building a BCP.
Sizer recommended starting with both historical and emerging risks. MSPs should:
- Review the organization’s history to identify known threats.
- Investigate additional risks, including operational and environmental threats.
- Account for reputational risks and public perception.
- Include legal, contractual, and compliance requirements.
“We do a lot of work in the local government realm, and they’re required to have both [BCP and DR] plans, and an Emergency Operations Center,” Sizer explained. She creates documented plans for each potential scenario and tests them regularly.
Additionally, a comprehensive BCP should cover all critical business functions and resources, Bloomfield added. At a minimum, plans should:
Mike Bloomfield
- Define clear roles and responsibilities
- Establish communication protocols for crisis situations
- Include a schedule for regular testing and review
“Disaster recovery is the process of restoring operations post-incident, and incident response is the immediate action upon facing a disruption,” he said.
Shift the Conversation From Tech Speak to Business Outcomes
One of the biggest challenges MSPs face is communicating the value of a BCP to business leaders.
Herbstritt said his business background helps bridge that gap. It allows him to focus on business outcomes instead of using acronyms and jargon like RTOs (recovery time objectives), RPOs (recovery point objectives), and backup architectures. His firm often acts as a virtual CIO, helping clients:
Michael Goldstein
- Develop policies and procedures
- Address compliance requirements
- Implement and operationalize continuity strategies
Goldstein reinforced that positioning. “It’s not an upsell, it’s business planning.”
Test, Train, and Operationalize the Plan
A business continuity plan is only as effective as its execution, according to Sizer. “Communicating a continuity plan took practice. A good plan isn’t just a handbook.”
She emphasized the importance of:
- Running scenario-based exercises
Dawn Sizer
- Involving employees, contractors, and partners
- Practicing communication workflows during simulated incidents
“Knowing what to do in case of an incident made communications in a time of crisis less stressful,” Sizer added. “Having a software package that can step you through the process and documents, reports, and sends notifications is extremely helpful as well.”
Goldstein offered an example of a proactive approach during hurricane season. About 10 days before a storm, his team verified backups across all clients. “It gave them the warm fuzzies,” he recalled.
Build a Resilient Technical Foundation
While the conversation should stay business-focused, execution still depends on strong technical architecture.
Herbstritt emphasized redundancy and layered protection, what he called “The Threes”:
Bryan Herbstritt
- File-level replication
- Full system backups (both cloud and local)
- Storing data in at least three locations
He also standardized on a two-server setup, even for small businesses, using Hyper-V to replicate workloads. Each server could carry the full load if the other failed.
Servers were backed up to Acronis, enabling recovery across multiple environments. “If there’s a disaster on-prem, we could recover VMs in minutes unless the data storage jumped into the terabytes,” said Herbstritt. “With Acronis we could recover quickly to other host machines to whatever was running on-prem.”
How MSPs Can Monetize Business Continuity
There’s no single pricing model for BCP services, but MSPs are finding multiple ways to package and deliver value.
Goldstein said his team often includes planning as part of a broader service offering. Larger clients get proof-of-concept exercises, including replication to Azure and failover/failback testing, he explained. “Most customers just wanted their applications up.”
He also noted that regulatory and insurance pressures standardized many baseline protections, including:
- Air-gapped backups
- Off-site cloud storage
- Separate backups for Microsoft 365
Meanwhile, cyberthreats have shifted the conversation. “Everyone knows someone who got hacked,” Goldstein emphasized. “Cybersecurity and ransomware concerns are top of mind.”
Herbstritt uses compliance requirements like HIPAA, along with cyber insurance considerations, to drive BCP adoption. “We tell them how we do business, our minimum level of services, and let them know a good plan would help control cyber insurance costs,” he shared.
Of course, delivering BCP services requires the right capabilities. “Everything can be monetized, but not everything can be done without expertise,” she cautioned. “The MSP takes on a lot of risk and liability to write a plan. If it’s poorly written, you risk your reputation and business.”
Bloomfield said he offers BCP both as a standalone service and as part of higher-tier packages. “Offering BCP as a service provides businesses with valuable expertise they might not have in-house,” he said. “That way, we keep them ready for any disruption.”
The Bottom Line: Lead With Continuity, Not Just Backup
Every region faces its own risks, from hurricanes and wildfires to floods and earthquakes. But today, security threats are the universal driver.
“We’re all fighting ransomware and other cyberattacks, and those drove today’s backup,” Goldstein said.
For MSPs, the opportunity is clear: Move the conversation beyond backup and disaster recovery. Help clients understand the full scope of business continuity—and position it as an essential part of doing business, not just an IT add-on.
Featured image: Andrey Popov — stock.adobe.com
