Last month I looked at a contract for a 60-person auto supplier in Auburn Hills. Their managed service provider was charging them $1,400 a month for what the invoice called managed backup and disaster recovery. When we dug into the actual job logs, the offsite sync had been failing silently since October. Nobody had checked. The local appliance was flashing green, so the billing department kept paying the bill.
That is the quiet trap with data backup services. Backups are invisible until the morning your production server gets hit with ransomware or an electrical surge kills a storage array in your server closet. Then everyone looks around the room wondering who actually verified the data.
If you run a business in Wayne, Oakland, or Macomb County, you have dozens of IT companies offering backup solutions. Some charge per gigabyte, some charge per seat, and some bury the fees inside a larger managed services agreement. Here is what the work actually involves, what it should cost, and how to tell whether your provider is protecting your operation or just cashing monthly checks on an unmonitored script.
What Real Data Backup Actually Involves
Many business owners assume backing up data means copying folders to OneDrive or syncing a virtual machine to an Amazon S3 bucket. That covers basic file storage, but it does not cover business continuity. If your primary domain controller dies at 8:00 AM on a Tuesday, having raw files stored in the cloud will not get your staff back to work before lunch.
True data backup for a 30 to 200 person organization covers three distinct layers:
- Local image-based snapshots: An on-premises appliance captures full system states, including the operating system, applications, database indexes, and system configurations. If a physical host fails, an engineer can spin up that snapshot as a virtual machine directly on the appliance in twenty minutes.
- Air-gapped and immutable offsite copies: Data must leave your building. It also needs to be written to storage that cannot be deleted or modified, even if an attacker gains domain administrator credentials. CISA guidance on ransomware repeatedly flags that modern attackers target backup repositories first before encrypting primary storage. If your offsite repository shares local admin credentials with your domain, it is not safe.
- Documented, scheduled test restores: A backup you have never restored is just a theory. A legitimate service includes routine restore testing where an engineer boots the image in an isolated network sandbox, verifies database integrity, runs basic check commands, and logs the result.
If your provider is not testing restores and showing you the logs, you do not have a managed backup service. You have a backup software subscription with zero supervision.
Local Industry Realities in Metro Detroit
Backup needs shift dramatically depending on what you build, sell, or manage. In our work across Detroit IT services and the surrounding suburbs, we see distinct failure points across local industries:
Manufacturing and Logistics (Warren, Livonia, Auburn Hills) If your ERP goes down, shipping stops. For Tier 1 and Tier 2 suppliers running tools like Plex, Epicor, or legacy on-prem SQL databases, recovery time objective (RTO) is the metric that matters. You cannot wait four days to download two terabytes over a standard commercial fiber connection while trucks sit idling at the loading dock. You need local failover capabilities tied directly into your core IT infrastructure.
Healthcare Systems and Specialty Clinics (Troy, Southfield, Detroit) HIPAA requires verifiable, encrypted backups with strict audit trails. If you manage imaging files, electronic health records, or clinical databases, your storage footprint grows fast. Providers often try to quietly increase per-terabyte rates once you pass arbitrary data caps, turning a predictable monthly expense into an unpredictable invoice.
Professional Services and Real Estate (Downtown, Birmingham, Royal Oak) Accounting firms, law practices, and commercial developers deal with high document turnover, dispersed teams, and heavy SaaS reliance. Backing up local laptops is not enough. You must back up cloud repositories, including Microsoft 365 mailboxes, SharePoint libraries, and SaaS platforms that do not provide native point-in-time recovery.
What Does It Cost in Metro Detroit?
Pricing in our market generally falls into three models:
1. Appliance-plus-cloud hybrid (BDR): You pay for a local hardware appliance (purchased outright for $2,000 to $6,000, or rented monthly) plus a monthly fee for cloud storage and management. For a company with two to four servers and 2 TB of active data, expect to pay between $450 and $1,200 per month. The wide range comes down to how frequently snapshots are taken and whether the provider includes spin-up cloud disaster recovery credits. 2. Per-user bundled pricing: Many local MSPs bundle backup into a flat seat fee (typically $125 to $225 per user per month). This usually covers workstation backups and Microsoft 365 cloud-to-cloud backups, but double-check whether critical on-prem databases, physical shop-floor terminals, or warehouse controllers are included. Often, they are carved out as extra line items. 3. Pure cloud consumption: If your infrastructure is fully hosted in Azure or AWS, you pay for cloud backup storage and snapshot policies directly. For a mid-sized business, storage costs might only run $150 to $500 monthly, but the management, configuration, and monitoring labor from an IT firm will add $300 to $800 to that figure.
Watch out for data egress fees. Some budget providers offer cheap monthly storage rates, but if you actually need to pull 5 TB of data back down after an emergency, cloud transfer fees can cost thousands of dollars on a single recovery ticket.
The Crucial Question to Ask Your Provider
When was the last time your provider did a bare-metal test restore from an offsite copy?
Ask them today. Most will tell you that automated daily notification emails mean everything is fine. That is the wrong answer. Automated emails only confirm that a backup job completed, not that the data can be read, mounted, and booted without corruption. If they cannot produce a written log showing the date of the last test, how long the restore took, and the name of the engineer who verified it, your business is exposed.
Understanding your exposure is a basic part of cybersecurity and risk management. Federal agencies like the FTC provide cybersecurity guidance showing that unverified backups are among the most common vulnerabilities leading to severe financial loss for small businesses.
How to Separate Competent Providers from Resellers
Many IT companies in Southeast Michigan are simply white-labeling a software package, adding a 40 percent markup, and setting up a dashboard alert. When evaluating options or learning how to choose an IT provider, look for these traits:
- They talk about RTO and RPO before they talk about software. Recovery Time Objective is how long you can afford to be down. Recovery Point Objective is how many hours of data you can afford to lose. If they pitch a software brand before asking those two numbers, they are selling a product, not designing a solution.
- They include immutable cloud storage by default. If their backup plan does not protect against an attacker wiping the cloud repository, the architecture is outdated.
- They own the test schedule. Testing should happen at least quarterly for critical servers and annually for secondary archives, with written sign-offs provided to your leadership team.
- They do not hold your encryption keys hostage. You should hold the master administrative keys to your backup repositories. If you part ways with the provider, you must be able to access your data without their permission.
FAQ
Is Microsoft 365 backed up automatically by Microsoft? No. Microsoft guarantees platform availability, not data retention. If an employee deletes an entire mailbox, or ransomware corrupts your OneDrive files, Microsoft will not restore your point-in-time files past their standard recycle bin retention windows (often 30 to 93 days). You need third-party cloud-to-cloud backup for Microsoft 365.
How often should our business run backups? For critical databases and active file shares, modern snapshot appliances should capture data every 15 to 60 minutes during business hours. Workstations and static servers can be backed up once daily, usually overnight. Offsite synchronization should happen continuously or at the end of every business day.
What is the difference between data backup and disaster recovery? Data backup is the process of copying and storing your files and system images. Disaster recovery is the strategy, tooling, and process used to quickly restore systems, network connections, and operational workflows after an outage. Backup is a component of disaster recovery, but backup alone will not keep your doors open.
Sources
- CISA Guidance on Phishing and Ransomware
- FTC Cybersecurity Guidance for Small Business
If you want an independent review of your backup contracts, data retention schedules, or IT service agreements, we can help. Book a free 15-minute review with our team to look over your current setup and identify where you might be overpaying or leaving your business exposed.