Ask a business "do you have backups" and the answer is usually yes. Ask "backups of what, exactly" and the room gets quiet. The server has backups. The laptops don't. Microsoft 365 is assumed to back itself up, which is mostly a misunderstanding. QuickBooks lives wherever QuickBooks lives. A backup strategy starts with an inventory, not a product.
Step one: list what you'd cry about losing
Walk your business and write down every place data lives that would hurt to lose:
- The server (if you have one): files, databases, the line-of-business app.
- Laptops and desktops. Policy says everything lives on the server or cloud. Reality says Karen's desktop has the only copy of the pricing spreadsheet.
- Microsoft 365 or Google Workspace. Email, OneDrive/Drive, SharePoint, Teams. The platforms replicate your data for their uptime, but their retention windows for your deletions and corruptions are short and not a backup. A deleted mailbox past the retention window is gone, and ransomware that encrypts synced files syncs the encryption.
- Cloud apps. QuickBooks Online, your CRM, the scheduling tool. Check each one's export options. Some SaaS data can only be protected by scheduled exports, so schedule them.
- The website. Files, database, DNS records, and the certificate story. Ask your web person where the backup is; enjoy the pause.
- The odd ducks. The door-badge controller, the phone system config, the NAS with the camera footage, the one Access database from 2011 that refuses to die.
Step two: match each item to a method
The framework is still 3-2-1: three copies, two media, one offsite. Applied per item: the server gets image-level backup, local plus cloud. Workstations either get enforced cloud sync with a real retention policy, or an endpoint backup agent. Microsoft 365 gets a third-party backup service (roughly $3 to $5 per user per month) that snapshots mail and files independently. SaaS apps get scheduled exports to somewhere you control. The website gets whatever its host offers plus an independent copy.
Step three: decide retention on purpose
How far back can you reach? Yesterday's backup is useless if the corruption happened last month and nobody noticed. Sensible small-business defaults: dailies kept for two weeks, weeklies for a couple of months, monthlies for a year, longer where taxes or compliance say so. Ransomware adds one more requirement: at least one copy immutable or offline, because attackers who get admin access delete reachable backups first.
Step four: make it somebody's job
Backups fail quietly: full disks, expired credentials, an unchecked box after a migration. Someone, internal or a provider, owns checking that every job on the inventory ran, weekly, and runs a restore drill on a calendar. Verification cadence belongs in your testing schedule, and untested backups belong in the fiction section.
The strategy, complete: an inventory, a method per item, retention chosen on purpose, one immutable copy, and a named owner who tests. Products change; the shape doesn't.
Want this handled instead of homeworked? That's the job.
Email us →