Almost every business we talk to says it has backups. Ask when someone last recovered a file from one, and the answer is often never. A backup only matters on the worst day: a failed drive, a stolen laptop, a deleted folder or a ransomware attack. This guide covers what a dependable backup looks like, and how to check yours.
None of it needs an IT department. A reliable setup for a small business comes down to a few habits: keeping enough copies in the right places, protecting those copies, and proving every so often that they can be restored.
Start with the 3-2-1 rule
A good yardstick is the 3-2-1 rule: three copies of every important file (the working copy plus two backups), on two different types of media, such as an office backup drive and a cloud service, with one copy stored off-site. If a fire, flood, storm or break-in hits the office, at least one copy is somewhere else.
Many businesses now add one more rule: at least one copy that cannot be changed or deleted for a set period, often called immutable or air-gapped. That is the copy that saves you from ransomware, because an attacker cannot encrypt or erase it even with your admin password. CISA's #StopRansomware Guide makes the same point: keep offline, encrypted backups of critical data and test them regularly.
Microsoft 365 and Google Workspace are not your backup
Cloud email and file services are very reliable, but they are built to keep the service running, not to undo your mistakes. Deleted items and version history are only kept for limited periods, and when a user, a sync error or an attacker deletes or encrypts files, the change syncs everywhere. A separate backup of mailboxes, OneDrive, SharePoint or Google Drive closes that gap.
Know what you are protecting
Before choosing a backup tool, write down every place your business data is kept. For most small businesses that means email and shared files, accounting and ERP data such as Odoo, QuickBooks or Xero, and line-of-business software and its databases, such as practice management or point-of-sale systems. Add the laptops and desktops where staff save things locally, whether they should or not, and your website, domain and DNS settings, which are easy to forget until something breaks.
For each one, write down two numbers: how much work you could afford to lose (a day? an hour?) and how quickly you need it back. Those answers decide how often you back up and what kind of backup you need.
Protect the backups themselves
A backup is only useful if it survives whatever took out the original, and ransomware attacks often go after the backups too. Use a separate login for the backup system, with multi-factor sign-in, so a stolen everyday password cannot reach it. Encrypt backups, especially anything that leaves the office, and keep at least one copy immutable or disconnected.
It also pays to know where your backups are physically stored. Some contracts and insurers ask for data to stay in the United States, and you will want to answer that question quickly when it comes up.
If you handle health or financial information
Backups are part of compliance, not only good practice. The HIPAA Security Rule requires covered entities and their business associates to have a data backup plan, a disaster recovery plan and an emergency mode operation plan for electronic patient information. If the FTC Safeguards Rule applies to your business, backups that contain customer information need the same encryption and access controls as the live data. Our FTC Safeguards Rule guide explains who is covered.
Prove it with regular restore tests
This is the step most often skipped. At least once a quarter, pick something real and restore it: a single file, a mailbox, a full laptop or your accounting database. Time how long it takes and write down anything that went wrong. A backup that has never been restored is a guess.
A five-minute self check
If you only have a few minutes, these five questions will tell you where you stand:
- Do you know where every backup is stored?
- Is at least one copy off-site and one copy protected from deletion?
- Are Microsoft 365 or Google Workspace backed up separately?
- Does someone get an alert when a backup fails?
- When did you last restore something, and did it work?
If any answer is "not sure", start there.
This article is general information, not legal advice. Confirm your obligations with your attorney or compliance advisor.
How we help
Bitnode Technologies designs, monitors and tests backups for US small businesses, with remote support nationwide and on-site visits by arrangement. If you would like a second opinion on your setup, our free IT assessment walks through the self check with you, or you can book a free 30-minute consultation to talk it over first.
Useful references
- #StopRansomware Guide, CISA, which covers offline, encrypted backups and restore testing.
- Ransomware guidance for small businesses, NIST Small Business Cybersecurity Corner
- 45 CFR 164.308, HIPAA administrative safeguards, including the contingency plan requirements, Electronic Code of Federal Regulations
Cover photo by Domaintechnik on Unsplash.