On this page
Most small businesses think they are backed up until the day they need to restore something. A deleted shared folder, a laptop that won't start, a website update that goes wrong: the real question is never whether a copy exists somewhere, but whether you can get your work back quickly and completely.
The 3-2-1 rule is a simple way to check.
What 3-2-1 means
- 3 copies of your data: the original and two backups.
- 2 different kinds of storage: for example, your cloud service plus a separate backup service, so one failure can't take out both.
- 1 copy offsite: kept away from your office and your main accounts, so a fire, theft or locked account doesn't reach it.
Many businesses now add one more step: a copy that can't be changed or deleted for a set period, often called immutable. It protects against ransomware, which tries to encrypt or delete backups along with everything else.
"Isn't it already in the cloud?"
Cloud apps like Google Workspace keep your files available and protect you from hardware failure. They don't protect you from mistakes or a compromised account. If someone deletes a folder, or ransomware on a synced laptop overwrites files, the cloud copy changes too. Trash folders and admin restore tools help, but they only reach back a limited time, usually measured in weeks.
A separate backup, stored outside the account it protects, covers what the cloud service doesn't.
What to back up
Make a list of where your business data lives. For most small businesses that includes:
- Email, calendars and shared drives
- Accounting and invoicing data (export it regularly, even from cloud accounting software)
- Your website's files and database
- Any business app with its own database or server
- Settings that are slow to rebuild, such as phone system menus, DNS records and server configuration
How often, and how far back
Two questions set your schedule:
- How much work could you afford to redo? If losing a day of work would hurt, back up at least daily. If losing an hour would, back up more often.
- How long until you would notice a problem? Mistakes and corrupted files sometimes go unnoticed for weeks. Keep enough history to reach back past that point, for example 30 to 90 days of daily copies plus monthly copies for longer.
Test your restores
A backup you have never restored from is a guess. Put a restore test on the calendar every quarter:
- Restore one file and one folder to a new location and open them.
- Restore your website to a test address and check that it loads.
- Time how long a full restore of your most important system takes.
Write down the steps as you go. The person restoring data on a bad day may not be the person who set up the backups.
A simple starting plan
| What | Backup method | How often | Kept for |
|---|---|---|---|
| Email and shared drives | Separate cloud backup service | Daily | 90 days or more |
| Website and database | Automated backup to separate storage | Daily | 30 days or more |
| Accounting data | Export to a backed-up folder | Weekly | At least a year |
| Phone, DNS and server settings | Written notes and exported settings | After each change | Current and previous version |
Adjust it to your business, then make one person responsible for checking that backups run and that restore tests happen.
When to get help
If you're not sure what you have, or you have never tested a restore, a short review will show where the gaps are. Our cloud hosting and backups service covers setup, monitoring and restore tests, and an IT review checks backups alongside the rest of your setup.
Frequently asked questions
Is an external hard drive in the office a good backup?
It's better than nothing, but it fails the offsite part of 3-2-1 and is easy to forget. Use it as one copy alongside an automatic offsite backup, not instead of one.
How much does a backup service cost?
Backup for business email and files is usually priced per user per month, and website backups are often included with hosting or offered as a low-cost add-on. Compare the price with the time it would take to rebuild lost work.
Who should be able to delete backups?
As few people as possible, and ideally not the accounts used for everyday work. If an everyday account is taken over, the attacker shouldn't be able to reach the backups as well.
BookedTeam
Written by BookedTeam (BookedTeam LLC), an IT consulting company that sets up and supports email, phones, websites, cloud hosting and automation for small businesses.
Related services