Article · Backup & Cloud
What a good small business backup plan looks like
The 3-2-1 backup rule in plain English, why Microsoft 365 still needs a backup, how ransomware changes the plan, and why an untested backup isn't a backup.
Most businesses believe they have backups. Fewer have tested whether they can actually get their files back, and how long it would take. A good backup plan is less about the software and more about answering three questions: what’s protected, where the copies live, and how fast you can recover.
Start with the 3-2-1 rule
It’s an old rule because it works:
- 3 copies of your data: the original plus two backups.
- 2 different kinds of storage, so one failure can’t take out everything.
- 1 copy off-site, away from your office, in case of fire, flood or theft.
Today there’s often a fourth piece: at least one copy that can’t be changed or deleted for a set time (called immutable). That’s what protects you from ransomware, which tries to encrypt or delete your backups along with your files.
Don’t forget Microsoft 365
A common surprise: Microsoft keeps Microsoft 365 running, but protecting your data is largely your job. Deleted emails and files sit in recycle bins for a limited time, then they’re gone. A former employee’s mailbox removed months ago, a folder someone deleted and nobody noticed, or a ransomware attack that syncs encrypted files into OneDrive can all fall outside what Microsoft can bring back.
A separate Microsoft 365 backup covers email, OneDrive, SharePoint and Teams, and lets you restore a single file or a whole mailbox from a specific date.
What to protect
- Microsoft 365: email, OneDrive, SharePoint and Teams
- Business applications: accounting, practice management or line-of-business software, especially if it runs on a server in your office
- Servers and shared drives still in the office
- Laptops, if people save files anywhere other than OneDrive
- Settings and records: firewall configuration, domain and DNS records, and a list of who has admin access to what
Two numbers to decide
How much can you afford to lose? If backups run nightly, a failure late in the day loses that day’s work. If that’s not acceptable, back up more often.
How long can you be down? Restoring a few files takes minutes. Rebuilding a whole server from backup can take a day or more. If that’s too long, you need a plan that can get key systems running faster, like spinning them up in the cloud.
Test it
A backup you’ve never restored from is a hope, not a plan. At least a few times a year:
- Restore a few random files and confirm they open.
- Restore a mailbox or folder from a past date.
- For servers, test a full recovery and time how long it takes.
Write down what you did and how long it took. That record also helps when your cyber insurer asks how you protect your data. See Cyber insurance questionnaires: how to answer them honestly.
Warning signs
- Nobody can say when a restore was last tested
- Backups are on a USB drive that stays plugged into the server
- Backup alerts go to an inbox no one reads
- Microsoft 365 isn’t backed up at all
- Only one person knows how to restore anything
Want a second set of eyes on your backups? Learn more about our backup and disaster recovery service.