Backups for small businesses: a simple plan that works

Hardware fails, files get deleted by mistake, laptops are stolen and ransomware encrypts everything it can reach. A backup is what turns these events from a disaster into an inconvenience. Here is a simple plan that works for most small businesses.

1. List what you need to protect

Backups often cover the shared folder and forget the rest. Go through this list:

• Documents and shared files
• Email
• Accounting and invoicing data
• Your website and its database
• Business software data (customers, orders, stock)
• Configurations and licence keys that would take long to recreate
• Your password manager vault

2. Follow the 3-2-1 rule

Keep three copies of your data, on two different types of storage, with one copy in another location. For example: the original files, a backup on an external drive or a network storage device in the office, and an encrypted copy with an online backup service.

3. Keep one copy out of reach

Ransomware encrypts every file it can reach, including backups stored on a connected drive. Keep at least one copy that cannot be changed from your network: a drive that you disconnect after each backup, or an online backup whose version history cannot be deleted for a set period.

4. Remember that syncing is not backing up

Services that sync a folder to the cloud are useful, but they are not a backup. If a file is deleted or encrypted, the change is synced too. Some services keep previous versions for a limited time: check how long, and do not rely on them alone.

5. Automate, encrypt and keep versions

• Automate: a backup that depends on someone remembering will be forgotten one day.
• Encrypt: backups contain all your data, including personal data protected by the GDPR. Encrypt them, especially outside the office.
• Keep versions: several daily, weekly and monthly copies let you go back to a date before a problem started.

6. Test the restore

A backup is only useful if you can restore it. At least once or twice a year, restore a few files and, if possible, a complete system or your website to a test location. Write down how long it took and what was missing.

7. Make one person responsible

Name one person who checks that backups run and who receives the error messages. Write the restore steps in a short document, stored outside the systems it describes.

In short

1. List everything worth protecting.
2. Three copies, two types of storage, one elsewhere.
3. One copy that ransomware cannot reach.
4. Do not count on sync alone.
5. Automatic, encrypted, with versions.
6. Test the restore regularly.
7. One person responsible.

Want help setting this up? We can review your current backups and propose a plan that fits your size and budget. See our database service or our IT & cybersecurity service.