The subject surfaces the same way almost every time: a cyber insurance questionnaire, an audit from your largest client, a tender asking for your business continuity plan, or an outage that just happened.<\/p>\n
Backup and disaster recovery: the confusion that costs money<\/h2>\n
A backup copies data so you can get it back later. A disaster recovery plan organises the restart of a whole service: machines, network, DNS, certificates, licences, accounts, a written procedure and a named person to run it. You can therefore have flawless backups and no DR plan at all, and that is the most common situation among the Moroccan SMEs I meet.<\/p>\n
![\"Cloud](\"https:\/\/storage.googleapis.com\/arrowlancer-prod.firebasestorage.app\/blog-ma\/sauvegarde-cloud-pra-maroc-budget-2026\/1.jpg\")
<\/p>\n
The difference becomes concrete on incident day. Your data exists, somewhere, in object storage. Now someone has to provision new machines, reinstall operating systems, restore databases, find who holds the ERP licence, repoint DNS records, reissue certificates, reconnect the point of sale or payment terminal, and tell customers. Each of those steps takes hours when it has never been written down or rehearsed.<\/p>\n
The budget consequences differ too. Backup is sold by volume and retention. DR is sold by time to restore service. So you negotiate different clauses. For backup: volume, frequency, retention, immutability, restore cost. For DR: RTO, RPO, who declares the incident, who executes, and how often it gets tested.<\/p>\n
Backup and disaster recovery cost Morocco: the 2026 ranges<\/h2>\n
The figures below reflect what the Moroccan market looks like in 2026 for an SME with 20 to 200 users. They move with volume, service level and provider, so treat them as a negotiation reference rather than a price list.<\/p>\n
- \n
- Backup setup<\/strong> (inventory, retention policy, agents, a first round of test restores): MAD 8,000 to 35,000 one off.<\/li>\n
- Server or virtual machine backup<\/strong>: MAD 150 to 450 per VM per month, monitoring included.<\/li>\n
- Backup storage<\/strong>: MAD 0.80 to 3 per GB per month depending on storage class and retention, restore fees excluded.<\/li>\n
- Microsoft 365 or Google Workspace backup<\/strong> (mail, OneDrive or Drive, SharePoint): MAD 15 to 45 per user per month.<\/li>\n
- Cold standby<\/strong> (copies ready, machines built at incident time): MAD 1,500 to 6,000 per month.<\/li>\n
- Warm standby<\/strong> (pre-provisioned machines, powered off or downsized, databases replicated several times a day): MAD 6,000 to 20,000 per month.<\/li>\n
- Hot standby<\/strong> (continuous replication, failover in minutes): from MAD 20,000 per month, and well above that once several transactional databases are involved.<\/li>\n
- Writing the DR and business continuity plan<\/strong>: MAD 25,000 to 80,000 depending on the number of applications and sites.<\/li>\n
- Documented annual failover test<\/strong>: MAD 10,000 to 30,000 per exercise.<\/li>\n<\/ul>\n
Two costs get forgotten every single time. Hyperscaler data egress fees, billed per GB restored, which turn a large recovery into an unplanned invoice. And internal time: restoring an ERP pulls in your finance manager to verify entries, not just the managed service provider.<\/p>\n
RTO and RPO: the two numbers to negotiate before signing<\/h2>\n
RTO (Recovery Time Objective) is the maximum delay between the failure and the service coming back. RPO (Recovery Point Objective) is how much data you accept losing, expressed in time. A single backup at 2 a.m. gives you a 24 hour RPO: if the server dies at 6 p.m., you lose a day of data entry.<\/p>\n
Put a number on that loss before discussing technology. A distribution company recording 180 orders a day that loses a full day has to re-enter 180 orders from paper slips and emails, hoping every one left a trace. That work is counted in person-days and in stock discrepancies. Against that, moving from a 24 hour RPO to one hour (transaction log backups every hour) often costs a few hundred dirhams a month. Moving from one hour to five minutes requires replication, and that is where the price changes scale.<\/p>\n
What belongs in the contract, ideally per application rather than globally: the committed RTO and RPO, what happens when they are missed, how fast data is made available in a large restore, the retention period, and your right to run a restore test when you choose. A provider who will not write those numbers down is selling you storage, not recovery.<\/p>\n
Where it actually breaks<\/h2>\n
The recovery failures I have seen almost never came from failing technology. They came from five habits.<\/p>\n
- \n
- The backup nobody ever restored.<\/strong> The report has been green for two years and no one has rebuilt a full database to check it opens. A job copying a locked database file produces an unusable copy and a success report.<\/li>\n
- The copy inside the same failure zone.<\/strong> A backup disk in the same rack, a snapshot in the same region, a NAS plugged into the server’s UPS. Ransomware, fire and a long power cut take both.<\/li>\n
- Backups reachable with production credentials.<\/strong> That is exactly what an attacker looks for: encrypt the data, then wipe the copies with the rights just obtained. Hence immutable storage, where a copy cannot be modified or deleted before its retention expires.<\/li>\n
- Retention that is too short.<\/strong> Seven days protects you neither against corruption discovered three weeks later, nor against an attacker who stayed quiet for a month before pulling the trigger.<\/li>\n
- No written procedure.<\/strong> The only administrator who knows the restart order is on leave, the passwords live in their session, and the DR plan lives in their head.<\/li>\n<\/ol>\n
The cheapest fix on that list is the test. One full restore a year, timed, with a written report, tells you whether your RTO is realistic and gives you the document auditors and insurers ask for. A serious cloud security audit<\/a> opens by asking for the date of your last successful restore.<\/p>\n
CNDP and Law 09-08: where your copies should live<\/h2>\n
A backup holding personal data (customers, employees, applicants, patients) is still processing of personal data. First practical consequence: your retention periods apply to copies as well. Deleting a customer record from the database while keeping it for ten years in backups is an inconsistency any inspection will catch, and CNDP data retention periods<\/a> deserve to be settled before you pick a backup retention.<\/p>\n
Second, transferring personal data abroad is governed by Law 09-08 and goes through the CNDP. If your backups land in a European or American region, that is part of the file, along with the storage country, the identity of the processor and the contractual safeguards. The exact formalities change over time, so check their current state on the CNDP website before committing, or use a Law 09-08 compliance checklist<\/a> to frame the file.<\/p>\n
Third, the hosting contract should name the storage locations, replicas included, and cover return then destruction of data at the end of the agreement. Plenty of contracts describe production in detail and say nothing about backups.<\/p>\n
Moroccan sovereign cloud or hyperscaler: the effect on DR cost<\/h2>\n
This choice turns less on the price per gigabyte than on three factors. The first is administrative: keeping copies in Morocco simplifies the sovereign cloud and CNDP side of your paperwork and your answers to public tenders, which is worth management time. The second is restore throughput. Pulling 2 TB from remote storage over a 100 Mbps link takes roughly 45 hours under perfect conditions, so longer in reality. If your RTO is 8 hours, the copy has to sit close to wherever you plan to restart, whatever the provider.<\/p>\n
The third is elasticity. With a hyperscaler, warm standby costs little while it is switched off and becomes expensive the second you turn it on, which fits a rare disaster well. With a local provider, capacity is often reserved and therefore paid for continuously, but egress fees are low or zero and the invoice is predictable in dirhams. The mix we put in place most often: production and primary backup in Morocco, a secondary copy with a second provider, so one platform incident cannot take both. The sovereign cloud comparison<\/a> shifts every year, so ask the question again at each renewal.<\/p>\n
Building a recovery plan without blowing the budget<\/h2>\n
Nobody needs a fifteen minute RTO across the whole estate. Savings come from tiering. Take your application list and sort it into three levels: the ones that stop revenue within an hour (point of sale, order site, production line), the ones that survive a day (ERP, accounting, payroll) and the ones that survive a week (intranet, archives, internal tools). You only pay for replication at the first level.<\/p>\n
For everything else, the classic frame is enough for most SMEs: three copies of the data, on two different media, one of them off site and immutable. Add a written restart procedure with the dependency order, a timed annual test, and the call list. A cloud migration<\/a> is a good moment to raise all of this, since business data backup gets reconfigured during one anyway.<\/p>\n
A realistic budget for a Moroccan SME starting from nothing: MAD 15,000 to 40,000 for setup, then MAD 3,000 to 12,000 a month for decent backup with an out of zone copy, plus one annual test. Hot replication only earns its place when an hour of downtime costs you more than its monthly subscription, and that calculation takes half a day with your finance controller.<\/p>\n
Arrowlancer designs and runs these backup strategies and recovery plans on Moroccan sovereign cloud as well as on hyperscalers, as part of our cloud and infrastructure services<\/a>, with hosting contracts aligned with Law 09-08. If you need to price an RTO and an RPO before signing, or simply confirm that your current backups can be restored, get in touch<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
Backup and disaster recovery in Morocco: 2026 price ranges in MAD, the RTO and RPO numbers to negotiate, and the failures that cost the most.<\/p>\n","protected":false},"author":0,"featured_media":182,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[119],"tags":[681,684,687,63,690,166],"class_list":["post-181","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cost_and_planning-en","tag-business-continuity-en","tag-cloud-backup-en","tag-cloud-morocco-en","tag-cndp-en","tag-disaster-recovery-en","tag-it-budget-en"],"_links":{"self":[{"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/posts\/181","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/comments?post=181"}],"version-history":[{"count":1,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/posts\/181\/revisions"}],"predecessor-version":[{"id":184,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/posts\/181\/revisions\/184"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/media\/182"}],"wp:attachment":[{"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/media?parent=181"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/categories?post=181"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/tags?post=181"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- The copy inside the same failure zone.<\/strong> A backup disk in the same rack, a snapshot in the same region, a NAS plugged into the server’s UPS. Ransomware, fire and a long power cut take both.<\/li>\n
- Server or virtual machine backup<\/strong>: MAD 150 to 450 per VM per month, monitoring included.<\/li>\n