Picture arriving tomorrow to find your files gone — wiped by a bad drive, a mistaken delete, or an attack. What would it take to get running again? For a lot of small firms, the honest answer is “we’re not sure.” Research on business disasters has long found that a large share of companies that lose critical data never fully recover. The good news: a solid backup plan doesn’t need an enterprise budget. It needs a little planning and regular testing.
Know two numbers first
Before tools, agree on two targets. How much data can you afford to lose — an hour’s worth, a day’s? That’s your recovery point. And how fast do you need to be working again — an hour, a day? That’s your recovery time. These two numbers decide how often you back up and how you restore. Everything else follows from them.
Use the 3-2-1 rule
It’s the simplest guide that holds up: keep three copies of important data, on two kinds of storage, with one copy kept off-site or in the cloud. That way a single failure — a dead drive, a flood, a ransomware lock — can’t take every copy at once. Cloud services like Microsoft 365 add version history and easy off-site storage, but watch the gap many owners miss below.
Don’t assume the cloud backs you up
Saving files in a cloud app is not the same as backing them up. If a file is deleted or encrypted, that change often syncs everywhere. Most cloud providers protect their own systems, not your content, past a short window. A separate backup of your cloud data closes that gap and pairs naturally with your broader technology plan.
Automate it, then test it
A backup you have to remember is a backup that fails. Set it to run on its own — often for critical data, less often for archives. Then do the part almost everyone skips: test a restore. A backup you’ve never restored is a guess. Try one on a schedule, time how long it takes, and confirm the files actually open. That test is what turns a hope into a plan.
Write down who does what
When something breaks, you don’t want to invent a plan under stress. Keep a short, written page: who declares an emergency, who starts the restore, what comes back first, and who tells staff and customers. One named owner for backups beats a vague sense that “IT has it.”
Backup and recovery isn’t about buying the biggest system — it’s about two numbers and one habit. Decide how much data and time you can afford to lose, follow the 3-2-1 rule, back up your cloud data too, and test a restore on a schedule. The test is the whole point: an untested backup is just a hope.
A few fair questions
We’re on Microsoft 365 — aren’t we covered?
Only partly. Microsoft keeps its service running and holds deleted items for a short window, but it’s not a full backup of your content. A separate backup protects you from deletes, ransomware, and long-gone files.
How often should we test a restore?
At least a few times a year, and after any big change. The goal is no surprises: you want to know the restore works and how long it takes before you ever need it.
Does this affect cyber insurance?
Yes. Insurers increasingly ask whether backups are separated and tested. Our cyber-insurance renewal checklist shows what they look for.
Want to know whether your current backup would actually bring you back? Book 15 minutes with Wayne Libonati, President & CEO. Prefer to start on your own? Score your current IT relationship in about 3 minutes.
