It really can't be understated how many non-profits operate on a shoestring budget and over-extend that few staff they can afford as a standard operating procedure, and have very low technical skill among everyone as they're mission-focused with what little resources they have.

I've worked with and for a couple non-profits where IT help was someone's spouse or kid or brother willing to help out. Often I've been the spouse. Often a shared Google drive filled with poorly managed PII is the solution that works well enough...until something bad happens.

I know. I would expect a very hands-off backup process (for files it’d work better - it’s easy to set up file backups from a OneDrive to a cloud backup service), and, if the recovery is easy and obvious enough, the need to exercise it falls by a lot.

$500 also buys you 20+TB of local storage. It’s not cheap, and many non-profits might struggle with that, but it’s also a way to ensure that even if the world ends, the data is somewhere.

Maybe I am in echo chamber, but none I know exercised recovery plan… ;) except of power plants and othe critical infrastructures, and maybe large enterprises. Others imho use 3–2-1 approach but haven’t tried to recover data.

I am happy to say I have a different experience, but I’m in a different echo chamber, and have been in very regulated spaces where DORA is unforgiving. Ideally, for a non-profit, you want a hands-off process as much as you can. If you need to, backup to whatever your cloud provider has for S3 buckets, on a different account.