Backup
Off-site backup best practices for small business
The businesses that lose data are not the ones without backups. They are the ones with backups that never got tested. These are the practices we use with clients across Suffolk County, and the ones that actually prevent data loss.
Follow the 3-2-1 rule.
Three copies of your data. Two different types of storage. One copy off-site.
Most small businesses stop at one copy on a drive in the office. That is a start, but it is not protection. The off-site copy is the one that saves you when the office cannot be reached.
The rule is simple because it works. It has been the standard for decades, and it still is.
Test restores, not just backups.
A backup that has never been restored is a guess. We test restores for clients so we know the data comes back intact.
Testing monthly is reasonable for most small businesses. It takes minutes and it catches problems while they are cheap to fix.
The test is simple: pick a few real files, restore them, open them. If they open, the backup works. If they do not, you found the problem before it found you.
Encrypt everything.
Encryption protects data in transit and at rest. If a storage facility is ever compromised, encrypted data is unreadable without the key.
This matters for any business that handles client information. On Long Island, that includes accounting firms, law offices, and medical practices.
Encryption should be on by default, not an add-on you have to ask for.
Keep versions, not just the latest copy.
Ransomware often sits inside a network for weeks before it strikes. If your backup only keeps the latest version, the backup may already be infected.
Versioned backups keep older clean copies. That is what makes recovery from ransomware possible without paying.
Research shows most ransomware attacks now target backup locations. A provider that keeps versions an attacker cannot reach is protecting you properly.
Match retention to your business.
A month of daily versions covers most small business needs. Industries with compliance duties may need years.
Retention costs storage, so the right answer is what you actually need, not the maximum available.
We review retention with clients when their data changes, so they are never surprised by either a gap or a bill.
Watch the backup, or have someone watch it.
The most common failure mode is silence. The backup stops, and nobody notices for weeks.
Monitoring should alert someone the moment a backup fails. Better yet, someone should check it on a schedule and report the result.
That is what managed backup means. If you do it yourself, put a monthly reminder on the calendar. If you do not want to, call us.
Include Microsoft 365 and Google Workspace.
Cloud email and documents are not automatically backed up. The provider protects their servers, not your data.
A deleted mailbox or wiped shared drive can be gone for good. Adding cloud app backup closes that gap.
For most businesses, this is a small addition with real value.
Automate everything.
A backup that depends on someone remembering to run it will fail eventually. Automation is the only reliable schedule.
Backups should run daily, after hours, with no action needed from anyone in the office. The system handles retries when the internet drops.
Automation is also what makes the 3-2-1 rule practical. Nobody has to think about copies when the system makes them.
Separate backup from the systems being backed up.
If your backup software runs on the same server it is protecting, one failure takes both down.
The backup should live on different hardware, with its own credentials, and preferably managed by different access than daily operations.
This separation is what stops ransomware from disabling the backup along with the files.
Review the reports on a schedule.
Backup software produces reports for a reason. Someone should read them, or a managed provider should.
A monthly review catches slow drifts: a drive getting full, a computer falling out of the job, a license expiring.
Fifteen minutes a month. That is the price of knowing the backup works.
The cost of doing it right.
Business-grade backup is a modest monthly cost. Cloud storage alone runs about $9 to $20 per computer per month. Managed backup adds monitoring and testing.
Compare that to the cost of one hour of downtime, which research puts at thousands of dollars for small businesses.
The math has never been close. The cheapest working backup wins.
Know who owns the backup.
Every backup needs an owner: a person or a provider who is responsible for checking it, testing it, and fixing it when it fails.
When nobody owns the backup, everybody assumes someone else does. That assumption is how businesses lose data.
Write the owner's name down. Put a monthly reminder on the calendar. That simple step prevents most silent failures.
FAQ
Questions business owners ask.
How often should a business back up?
Daily is the standard for small businesses. If your team enters data all day, daily backups keep the loss window small.
Is cloud backup the same as off-site backup?
Cloud backup is one way to do off-site backup. It uses secure remote servers instead of a drive in another building.
How long should I keep backups?
Most small businesses keep several weeks of versions. This protects against ransomware and accidental deletion.
What is the 3-2-1 rule?
Three copies of data, on two types of storage, with one copy off-site. It is the standard practice for protecting business data.