Your backup is available. Your files are there. Yet nobody can sign in or access the applications they need. This scenario highlights an important distinction: recovering data and getting a business back to work are not quite the same thing.
News that broadens the backup discussion
On 27 October 2026, Dell announced new cyber resilience capabilities, including recovery for identity environments such as Active Directory, Microsoft Entra ID and Okta. These systems manage accounts and access. The announcement illustrates a useful shift: recovery must also cover the systems that allow people to sign in. Read Dell’s announcement.
What this means for an SME
An accounting firm, an association or a consultancy does not necessarily need a complex architecture. However, every organisation should be able to answer a simple question: if our usual environment becomes unavailable, how do we resume work, with whose help and in what order?
Consider a fictional example. A team recovers its backed-up documents, but its business application requires a central sign-in service that is no longer working. The files have been recovered; work is still blocked. Another possibility: the only person able to administer the services is unavailable. These dependencies should be identified before an emergency, without unnecessarily multiplying administrative privileges.
Four points to clarify with your IT partner
- Priority activities. Which tasks must resume first: answering customers, consulting records or preparing orders? Define an acceptable interruption period and how much work you could afford to recreate.
- Dependencies. For each activity, list the applications, data, internet connection and access required. A simple diagram can reveal gaps in the plan.
- Responsibilities. Who decides when work can resume? Who contacts the provider? Where can instructions be found if the usual email service is unavailable? A short procedure accessible to authorised people is better than a document nobody can find.
- A realistic exercise. Arrange a controlled test with a limited scope. Check that an authorised person can actually open the files and use the application they need. Record obstacles and the time required, then improve the plan.
Plan emergency access without weakening security
For Microsoft Entra ID, Microsoft recommends at least two emergency access accounts, protected and monitored, with appropriate strong authentication. Their purpose is to prevent administrative lockout; they are not a substitute for everyday accounts. IT administrators should organise their configuration and testing. This is not about sharing an administrator password with the entire team. Microsoft guidance on emergency access.
After a compromise, restarting quickly must not mean reusing untrusted access. Recovery should be validated in an environment considered trustworthy by those managing the incident. The appropriate measures depend on what happened: a lost phone, an outage and an intrusion require different responses.
Start with the right questions
Unsure what your current arrangements cover? MYCIO can discuss your cybersecurity and backup needs with you. The aim is to connect data protection with everyday operations: the people, access and tools your business relies on. Let’s talk about your IT environment.
Conceptual illustration generated with AI.