Almost every small business has some kind of backup. Very few have ever tried to restore something from it. That is where the real risk lies.
What a backup plan has to answer
A plan does not need to be long. It needs to answer five questions clearly, and in writing:
- What is backed up? Files, email, accounting, databases, the website.
- How often? Daily for anything that changes daily.
- Where to? At least one destination outside the office.
- For how long? How far back do you need to be able to restore a version?
- Who checks? One person who verifies that the backup actually ran.
The 3-2-1 rule
The proven rule of thumb: three copies of your data, on two different types of storage, one of them off site. A fire, water damage or a break-in at the office then never hits all copies at once.
Today a fourth point belongs on the list: at least one copy should not be permanently connected to the network, or should be protected against changes. Otherwise ransomware encrypts not only your data but also the backup sitting next to it.
Microsoft 365 is not a backup
Many businesses assume their data in the cloud is backed up automatically. Microsoft keeps the service running. But if an employee deletes a folder or an attacker encrypts files, those changes reach the cloud just the same. Once the retention periods have passed, deleted data is gone.
If you want email, OneDrive and SharePoint to be truly safe, you need a separate backup of that data.
An untested backup is a hope
The most common mistake is not a missing backup but one that has never been checked. Backups fail silently: a password expires, a disk fills up, a new folder was never included. You only notice when you need the data.
Our recommendation: restore a single file once a quarter and run through a full restore once a year. It takes an hour and tells you more than any status report.
Checklist for your business
- All important data is covered, including what sits on individual laptops.
- At least one copy is kept outside the office.
- One copy is offline or protected against changes.
- Email and cloud files are backed up separately.
- Someone regularly checks that the backup ran.
- A restore has been tested in the last twelve months.
If you hesitate on more than one point, a closer look is worthwhile. We review existing backups as part of our IT services and tell you honestly where the gaps are. Get in touch.