A small office is properly backed up when it follows the 3-2-1 rule and has proved it can restore. 3-2-1 means three copies of your data, on two different kinds of storage, with one copy kept off site. Testing a restore means actually getting files back from the backup and opening them, on a schedule, before you need to. A backup you have never restored from is a hope, not a backup. The checklist and the test are both below, and you can work through them in an afternoon.
3-2-1, in plain English
- Three copies. The original you work on, plus two backups. One backup is not enough, because backups fail too, and you tend to find out at the same moment you need them.
- Two kinds of storage. For example, a backup drive or storage box in the office and a cloud backup service. Two folders on the same computer, or two drives in the same server, count as one. The point is that a single failure should not take out both.
- One off site. Fire, flood, tornado, theft and power surges affect everything in the building at once. In Alabama, that is not an abstract worry. One copy has to live somewhere else: a cloud backup, or a drive that is physically taken off the premises on a routine.
The modern addition: one copy nothing can change
Ransomware looks for backups and encrypts or deletes them first. So one copy should be either offline (physically disconnected when it is not being written to) or immutable (a setting many backup services offer, where a backup cannot be altered or deleted for a set period, even by an administrator). A USB drive that stays plugged into the server all week is neither.
A sync folder is not a backup
OneDrive, Google Drive and Dropbox keep the same files on several devices. That protects you from a dead laptop. But if a file is deleted, overwritten or encrypted, the change syncs everywhere too. Version history and recycle bins help for a while and within limits. A backup is a separate copy, kept for a period you chose, that does not change when the original does.
Cloud email and files need a backup too
Microsoft and Google keep their services running, but what you put in them is your responsibility. Built-in retention has limits, and it is not designed to rebuild a mailbox that was emptied months ago by a departing employee or a compromised account. If your email and documents live in Microsoft 365 or Google Workspace, back them up with a separate service.
The backup checklist
What is backed up
- Every place business data lives is on a written list: the server or shared drive, each person’s computer, email, the accounting system, line-of-business software, the website, and phones if they hold photos or records you need.
- Each item on the list has a named backup. Nothing is marked “probably.”
- The accounting or database software is backed up in a way its maker supports. Copying a database file while it is open can produce a backup that will not open.
- Laptops that leave the office are included.
How it is backed up
- Backups run automatically, at least once a day for data that changes daily. Nothing depends on someone remembering.
- There are three copies on two kinds of storage, with one off site.
- One copy is offline or immutable.
- Backups are encrypted, and the encryption key or password is stored somewhere other than the system being backed up.
- Older versions are kept, not just last night’s. Decide how far back you need to reach: a file damaged three weeks ago is no use if you keep seven days.
- The backup account is protected with multi-factor sign-in and its own password.
Who is watching
- Someone receives an alert when a backup fails, and someone checks even when no alert arrives. Silence can mean the job stopped running.
- Two people know how to restore, and the steps are written down.
- The backup login, provider phone number and steps are also kept on paper or outside the network, so you can reach them when the network is down.
- A restore test is on the calendar.
Two numbers to decide before you choose a system
How much work can you afford to lose? If the answer is “a day,” nightly backups will do. If losing a morning of orders would hurt, you need backups through the day. IT people call this the recovery point objective.
How long can you be down? Restoring a whole server from the cloud over an ordinary office internet line can take many hours or days. If you need to be working again the same day, you need a local copy to restore from, or a system that can run your server from the backup while the real one is repaired. This is the recovery time objective. Write both numbers down. They decide what you should buy.
How to test a restore
The quarterly file test (about 15 minutes)
- Pick three things: a document someone edited yesterday, a file from about a month ago, and one whole folder.
- Restore them from the backup to a different location, such as a new folder on another computer. Do not restore over the originals.
- Open each one. Check that it is the version you expected and that it is not damaged.
- Do the same for one mailbox item if your email is backed up.
- Write down the date, what you restored, how long it took and who did it.
The yearly full test (a few hours)
- Pick the system you could least afford to lose, usually the accounting database or the main file server.
- Restore the whole thing to a spare computer or a test environment, not over the live system.
- Start it up and have the person who uses it every day confirm it works: open the company file, run a report, find last week’s entries.
- Time the whole process, from “we need to restore” to “we are working.” Compare it with how long you said you can be down.
- Note everything you needed and did not have to hand: a license key, an installer, a password. Fix each one.
What counts as a failed test
- The file is not in the backup at all.
- The newest copy is older than you expected.
- The restored file or database will not open.
- Nobody can find the backup password or encryption key.
- The restore takes far longer than the business can stand.
Any of these, found in a test, is a good result: you found it on a quiet afternoon.
Common mistakes
- One USB drive, always plugged in, never swapped.
- Backing up the server but not the computers where people really save their work.
- Assuming the software vendor or the cloud provider is backing things up for you, without asking for it in writing.
- Backup alerts going to the inbox of someone who left the company.
- Never testing.
Where we fit
Backup monitoring and management is part of our managed IT plan at $175 per user, per month, with a 5-user minimum, and a review of your backups is part of every IT assessment. Backups are also one of the fifteen items in our security self-check, and one of the first things a cyber insurance application asks about. For Microsoft 365 questions, see Microsoft 365 and cloud. If you would like a second pair of eyes on yours, request an IT assessment.