Most small businesses believe their data is backed up. Fewer can say exactly what is backed up, where the copies are, and when someone last tested a restore. Those three questions are the difference between a backup that saves the day and one that only exists on paper.
This guide covers the basics in plain language: what to protect, how cloud backup fits in, and the common mistakes that leave businesses exposed.
Start with what you'd lose
Before choosing any tool, make a list of the data your business can't function without. Typically that includes:
- Shared files: documents, spreadsheets, contracts, client folders.
- Email, calendars, and contacts.
- Accounting and business application data.
- Files saved only on individual computers — often more than anyone realizes.
- Server data, if you have an on-site server.
- Configuration you'd need to rebuild: network settings, application setups, important passwords stored securely.
For each, ask: if this disappeared today, how much would we lose, and how long could we work without it? The answers tell you how often each type of data needs backing up and how quickly you need to be able to restore it.
Sync is not backup
This is the most common misunderstanding. Services like OneDrive, Google Drive, and Dropbox sync files: change or delete a file in one place and the change appears everywhere. That's convenient — and it means that if a file is deleted by mistake, overwritten, or encrypted by ransomware, the damage syncs too.
These services do offer version history and recycle bins, which help, but they have limits and retention periods. A true backup is a separate copy, kept independently, that a mistake or attack in your live system can't reach.
Your cloud apps need backup too
Moving to Microsoft 365 or Google Workspace doesn't automatically mean your data is backed up in the way you might expect. These providers keep their services running, but protecting you from your own deletions, a departed employee's removed account, or a compromised login is largely your responsibility. Read your provider's documentation on retention, and consider whether a separate backup of email and files is right for your business.
The 3-2-1 rule
A widely used rule of thumb for backup is 3-2-1:
- 3 copies of your data — the original plus two backups.
- 2 different types of storage — for example, a local device and the cloud.
- 1 copy kept off-site — away from your office, so a fire, flood, or theft doesn't take everything.
Cloud backup is the easiest way for a small business to get the off-site copy. A local backup adds fast restores for everyday mistakes. Together they cover most situations.
Protect the backup itself
Ransomware increasingly targets backups, because a business that can restore doesn't need to pay. A few principles help:
- Keep at least one copy that can't be modified or deleted from your everyday computers — many backup services offer "immutable" or versioned storage for this reason.
- Use separate, strong credentials with multi-factor authentication for the backup system.
- Don't leave a backup drive permanently connected to a computer that could be infected.
Test your restores
A backup you've never restored from is a hope, not a plan. Periodically pick a file, a folder, or a mailbox and actually restore it. Note how long it took and whether anything was missing. For important systems, think through what a full recovery would involve and how long the business would be without it.
Also check that backups are actually running. Many backup tools send alerts or reports — make sure they go to someone who reads them.
Write it down
A short backup plan should answer: what's backed up, how often, where the copies are, who's responsible for checking, and the steps to restore. Keep it somewhere you could reach even if your main systems were down.
A simple starting checklist
- List your critical data and where it lives today.
- Confirm which of it is backed up, and where.
- Make sure at least one copy is off-site and protected from deletion.
- Check how your Microsoft 365 or Google Workspace data is protected.
- Restore something as a test, and put a reminder in the calendar to do it again.
Backup and recovery planning is part of both cloud and systems advisory and security consulting. If you'd like an independent look at whether your data could really be recovered, that's a good place to start.