Backups in a small business: the 3-2-1 rule and the test nobody runs

Backups in a small business: the 3-2-1 rule and the test nobody runs

Having a backup is not the same as being able to restore. What to back up, where, how often, why syncing is not backing up and how to run the one test that proves your backup works.

· Security

Almost every small business believes it has backups. Very few have ever checked that they can be restored. And that is the whole difference: a backup that has never been restored is not a backup, it is an assumption.

This article is about turning that assumption into a verified fact, without buying anything expensive.

Syncing is not backing up

Let us start with the most widespread and most dangerous misunderstanding. Having your files on a cloud drive — whichever one — is not a backup. It is a sync, and syncing propagates disasters:

  • If you delete a folder by mistake, it is deleted everywhere.
  • If a file becomes corrupted, it uploads corrupted.
  • If ransomware encryption arrives, the encrypted files sync over the good ones.

What saves you in those three cases is versioning and history: being able to go back to how the folder was last Tuesday. Check today how many days of history your service keeps and whether it includes deleted files. It is a concrete figure, it is in the settings, and plenty of people discover it is seven days when the problem was spotted three weeks in.

The 3-2-1 rule

It is the simple standard and it is still the right one:

  • 3 copies of the data (the original and two copies).
  • 2 different media (for example, a local disk and the cloud).
  • 1 copy off site, and disconnected.

That «disconnected» is the key against modern ransomware, which actively hunts for network drives and reachable backups to encrypt them too. A backup the infected machine can write to does not count as a backup. An external disk connected once a week and kept somewhere else does.

What to back up (and what is always forgotten)

The obvious list: documents, accounts, invoices, the management system's database, email.

The list that gets forgotten and hurts as much or more:

  1. Digital certificates, exported with a password. Without them nothing can be filed with the administration.
  2. The website: files and database. Many hosting providers keep backups, but for few days.
  3. Keys and accesses, in a password manager with its own backup.
  4. The configuration of the management software, not just the data.
  5. The files that live in email: if your whole operation is in the attachments of one account and that account is lost, it goes with it.

The two questions that define your plan

Before choosing a tool, answer them with a number:

How many hours of work can you afford to lose? If the answer is «a day», a daily backup will do. If it is «an hour», you need continuous backups. That figure decides the frequency and the cost.

How long can you be down? Restoring two terabytes from the cloud over a domestic connection takes days. If your business cannot be down for two days, you also need a fast local copy. The remote copy protects you from fire; the local one protects your time.

The restore test

And now the only thing that turns all of the above into something real. Once a quarter, actually restore. Do not look at the green dashboard: pick any file from three weeks ago, restore it into a separate folder and open it.

The failures that show up in that test and at no other moment:

  • The backup has been failing for months and the alert was going to an inbox nobody reads any more.
  • A folder that stopped being used a year ago was being backed up, and the new one was not.
  • The backup is encrypted and the password was known by somebody who has left.
  • The file restores, but the program that opens it no longer exists on any machine.

Write the date of the last test somewhere visible. If that date is more than three months old, you do not know whether you have backups.

The reasonable minimum for a small business

  1. An automatic daily backup to a service with at least thirty days of history.
  2. A weekly copy to a disconnected external disk, kept in another building.
  3. Certificates and passwords included and verified.
  4. A failure alert to an inbox somebody actually reads.
  5. A quarterly restore test, with the date written down.

None of that requires serious investment. It requires somebody to be responsible for it happening.

If this sounds like you

Backups are half of a small business's security; the other half — accesses, email, second factor — we cover in the security minimum. Setting it up and leaving it working, restore test included, is security and compliance.

And if you also handle customer data, backups stop being merely good practice: data availability is a legal obligation, and we cover it in using AI with customer data within the law.

We are Mindset & Code: automation, data and development for small businesses. You can see what we do and what it costs.

Sources: INCIBE, backup and ransomware response guidance for small businesses. General guidance; the specific plan depends on the data volume and the downtime you can absorb.