A plain guide to business backup

Start with what you would miss

It is common to back up the server and forget the rest. Start instead with a list of everything the business would miss by Friday if it vanished on Monday, and write the name of an owner beside each item.

A typical list for an office of 5 to 200 people:

• Servers: the whole machine, with its operating system, apps, settings and permissions, not only the shared folders.
• NAS shares: project archives, scans and everything staff were told to “just save to the drive”.
• Laptops and desktops: documents, desktops and app data that never reach a shared folder.
• Microsoft 365 or Google Workspace: mail, calendars, OneDrive or Drive, SharePoint or shared drives, and Teams chats.
• Line-of-business apps: accounting, practice management or job costing databases, copied in a consistent state.
• The things nobody lists: firewall and router settings, DNS records, license keys and where admin passwords are kept.

Then ask two questions of each item: how much work could we lose, and how long could we wait? A property manager’s rent ledger might bear an hour of lost work at most. Last year’s closed leases could wait a week. Writing both answers down is the step most often skipped, and it decides everything that follows.

For hosted software you do not run yourself, ask the vendor two more questions: can we export our data, and how far back can you restore it? If the answers are vague, keep your own export on a schedule.

Where your copies should live

The old rule still holds. The 3-2-1 rule says to keep three copies of your data, on two different kinds of storage, with one copy off site. The live data counts as one copy, so you need two backups, and they should not share a building.

Ransomware changed what “off site” has to mean. CISA’s #StopRansomware Guide warns that “many ransomware variants attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid.” The same guide tells organizations to “maintain offline, encrypted backups of critical data.” A copy that someone can reach with a stolen admin password is not a safe copy.

That gives three tests for the off-site copy:

• Far enough: in a different region, so one storm, flood or power cut cannot reach both. We keep ours at least 500 miles apart.
• Locked: immutable, meaning nobody can change or delete it for a set period, administrators included. Ours lock for 30 days by default.
• Encrypted: at rest and in transit, with a clear answer to who holds the key.

A NAS on the shelf makes a fast local copy, but it is still one copy in one building. File sync is not backup at all: when a file is deleted or encrypted on one laptop, sync copies that change to every other device. Use sync for working together and backup for getting things back. Read more in A NAS on the shelf is not a backup and Backup and sync are not the same.

If you already run a NAS or a local backup, the Immutable Offsite Copy plan adds the locked, far-away copy on top of it.

Match the schedule to the work

A backup schedule is your recovery point written as a timetable. If the last copy ran at midnight and the server fails at 4 p.m., the day’s work is gone. So the right schedule depends on how much work each system can lose, not on what the software does by default.

Three patterns cover most small offices:

• Laptops and desktops: copy changed files every hour while the machine is online, wherever it is.
• Servers: a full image every night, plus file versions every hour.
• Cloud apps: copy mail and files several times a day, because people delete things all day long.

An image backup copies the whole disk, so a failed server can be rebuilt in one step instead of reinstalled from memory. A file backup copies documents and folders, which is quicker for everyday restores. Servers need both. Laptops usually need files only, since a replacement laptop arrives with its own operating system.

Run heavy jobs when nobody is working, such as 11 p.m., and check that they finish before people arrive. A nightly job that runs into the morning slows everyone down and tempts someone to switch it off.

A schedule only counts if someone reads the failures. Backup software stops quietly after an update, a full disk or a laptop that never comes back online. Name the person who reads every failed job, and agree that it is fixed the same business day. That is the rule we work to on Workstation Backup and Server Backup.

Keep versions longer than you think

Retention is how long old versions are kept. It matters because many problems are found late: a spreadsheet saved over in June and noticed at year end, a folder deleted by someone who has since left, or an intruder who was inside for a while before anything was encrypted. If a backup keeps only two weeks of versions, any problem older than that cannot be undone.

A tiered pattern covers most needs:

• Daily versions for the last month, for everyday mistakes.
• Monthly versions for the last year, for problems found at quarter or year end.
• Yearly versions for several years, for audits, disputes and old projects.

Our server default is 30 daily, 12 monthly and 7 yearly versions. Workstations keep 90 days of versions, and Microsoft 365 and Google Workspace keep 1 year, extendable to 7. The locked copy needs its own setting too: ours stays immutable for 30 days by default.

How long you must keep certain records, such as tax files, patient charts or client matters, is a legal question. Ask your counsel or accountant, then set the backup to match their answer. Keeping everything forever is not free either: every extra year costs storage and holds data you may later be asked to delete. How long should you keep backups? goes further.

Test a restore, not a report

A green tick in a backup report proves the job ran. It does not prove the copy opens, the server boots or the restore finishes before the business needs it. Only a restore proves that.

CISA’s #StopRansomware Guide says to “regularly test the availability and integrity of backups in a disaster recovery scenario.” The gap between having backups and using them is real: Sophos’s State of Ransomware 2025 found that “only 54% of companies used backups to restore their data,” the lowest share in six years. That survey covered 3,400 IT and cybersecurity leaders at organizations of 100 to 5,000 employees in 17 countries, so it describes larger firms than most readers of this guide. The lesson still carries.

A useful test has four parts:

• A sample of files from different dates, restored to a separate folder and opened.
• One mailbox or cloud account, to prove the cloud copy works too.
• One full system, such as a server or laptop, restored to an isolated environment where it cannot touch the live one.
• A written result: what was restored, how long it took, and what failed.

The timing matters as much as the result. If a full server takes 9 hours to restore and the business can wait 4, you have found something to fix before the day it counts.

We run this as the quarterly Restore Drill, with the written result sent within 3 business days. To try a smaller version yourself, read How to test a restore without breaking anything.

Cloud apps need their own copy

Microsoft 365 and Google Workspace keep your mail and files running. Their recycle bins help you get back what someone deleted, but only for a limited time.

Microsoft’s support documentation says that in SharePoint in Microsoft 365, “items are retained for 93 days from the time you delete them from their original location.” The Microsoft Services Agreement, in section 6.b, which covers Microsoft’s consumer services, says: “We recommend that you regularly backup Your Content and Data that you store on the Services.” Google Workspace has trash and retention settings of its own, with their own limits.

Three situations show the gap:

• A departed employee: removing their account or license can take their mailbox and files with it.
• A late discovery: a folder deleted months ago and noticed after the recycle bin has emptied.
• A sync accident: a deletion or encryption on one laptop, copied up to OneDrive or Drive.

A separate backup copies mail, files, calendars and chats to storage the provider does not control, on its own schedule and its own retention. Ours runs 3 times a day and keeps 1 year by default, extendable to 7, and on Microsoft 365 it keeps departed staff accounts too. See Microsoft 365 Backup and Google Workspace Backup, or read Does Microsoft 365 back up your data?

Decide who runs it

Every decision above can be made in an afternoon. The hard part is keeping it true every week for years: reading failures, adding the new laptop, keeping the departed user’s mail, running the test. So the real choice is who does that work.

There are three common paths:

• Run it yourself with backup software. It costs least, and it works if one person owns the checks and tests.
• Use your IT provider’s backup, often bundled into a wider contract. Ask to see the last restore test, not only the report.
• Hire a backup specialist that runs the copies and proves them on a schedule, alongside your IT person or provider.

You may not need a provider at all. A five-person office with no server and everything in Microsoft 365 might need only a cloud-app backup and a quarterly test. Our pricing page shows what each piece costs, and the 3-2-1 backup checklist keeps a do-it-yourself setup honest.

Whichever path you take, ask the questions in the table below before you sign. They work on any provider, including us.