Most small businesses have a backup. Far fewer have ever restored from one. A backup only proves its worth on the day you need it back, and that is a bad day to find out it does not work.
I learned this on my own servers. A nightly backup reported “success” for fourteen nights in a row while the copy to a second machine was failing every time. The script wrote each error to its log and then carried on, so it always finished as a success, and the alert never fired. Nothing was lost, but only because I went looking.
Three copies, two kinds of storage, one away from the building
The old 3-2-1 rule still holds. Keep three copies of anything that matters: the live data and two backups. Keep them on at least two kinds of storage, and keep one copy somewhere other than the office.
Add one more: one copy that ransomware cannot reach. That means a copy the office computers cannot write to or delete, such as storage that refuses changes for a set number of days, or a drive that is unplugged and taken home.
Test a restore, on a schedule
Put a restore test in the calendar, every three months at least. Pick something real: a folder somebody would miss, a mailbox, or the accounting file. Restore it somewhere safe, open it, and write down three things:
- whether it opened and was complete;
- how old the newest copy was;
- how long the restore took from start to finish.
The last number matters more than people expect. A backup that takes two days to come back may be fine for old photos and not for the system you invoice from.
Make failure loud
A backup that fails quietly is worse than none, because everybody believes it works. Whatever you use, check that:
- a failed run sends an alert to a person, not just a line in a log;
- someone looks at a success report at least weekly, and notices when one is missing;
- you have tested the alert by breaking the backup on purpose once.
Know what is not backed up
Cloud services are not automatically backups. Microsoft 365, for example, keeps deleted email for 14 days by default, which an administrator can raise to 30. After that it is gone. If losing a month of email or files would hurt, it needs its own backup.
Make a short list of where your data actually lives: the server, each laptop’s desktop folder, the accounting file, email, the website. Then mark which ones the backup covers. The gaps are usually laptops and email.
A one-page check
- Three copies, two kinds of storage, one away from the office.
- One copy that office computers cannot change or delete.
- A restore test every three months, with the time it took written down.
- An alert on failure, tested once.
- A list of where the data lives, with each item marked covered or not.
If you can tick all five, your backups will probably restore. If you cannot, the free IT check-up looks at exactly this.