Most businesses think they have backups right up until the morning they need one. Then they learn the backup stopped running six months ago, or it copied the files but not the database, or nobody knows the password to restore it. A backup you have never tested is not a safety net. It's a hope. Here is a short checklist to turn that hope into a plan.
The rule worth memorizing: 3-2-1
The standard that professionals use is simple enough to hold in your head. Keep three copies of anything important, on two different kinds of storage, with one copy kept off-site or in the cloud.
The original on your computer is copy one. A backup on an external drive or a second server is copy two. A copy in the cloud, or a drive stored somewhere else entirely, is copy three. The point of the off-site copy is the disaster that takes out everything in one place at once: fire, flood, theft, or ransomware that encrypts every machine on your network.
Why off-site matters: a backup drive sitting next to the computer it backs up is one burglary or one fire away from being useless.
What actually needs backing up
Walk through your business and list what would genuinely hurt to lose. It's usually more than files.
- Customer records and contacts, wherever they live.
- Financial and accounting data, including anything stored only inside an app.
- Your website and its database, which your host may or may not back up for you. Confirm, don't assume.
- Email, if your business depends on its history.
- Anything in a cloud tool you'd struggle to recreate: a hosted database, design files, project history.
A common blind spot is assuming cloud services back themselves up. They protect against their own hardware failing. They do not protect you from deleting the wrong thing, or an account being compromised. If losing it would hurt, back it up yourself.
The test that separates real backups from imaginary ones
This is the step almost everyone skips, and the only one that proves the rest worked. Once your backups are running, actually restore something. Pick a file, or better, a whole folder, and recover it from the backup as if the original were gone.
You're checking three things: that the backup contains what you expected, that you can access it without a lost password, and that you know how to do the restore under pressure. Do this now, calmly, so you're not learning the process during an actual emergency.
Then put a reminder in the calendar to test again every few months. Backups silently fail. A quarterly restore catches it before it matters.
Your ten-minute checklist
Run through these today.
- Is something automatically backing up your important data, without anyone remembering to do it?
- Do you have at least one copy off-site or in the cloud?
- Does the backup include your database and app data, not just loose files?
- When did a backup last actually run? Check the date, don't guess.
- Have you ever successfully restored from it?
- Do you know, or can you find, every password needed to restore?
Any "no" or "not sure" is your weekend project. It's a small amount of work to fix now, and a business-ending problem to discover later.
The short version
Follow 3-2-1: three copies, two types of storage, one off-site. Back up the data that would actually hurt to lose, including the app and cloud data people assume is safe. Then do the one thing that makes a backup real, which is restore from it and confirm it works. A tested backup is the cheapest insurance a business can buy. An untested one is a story you tell yourself until the day it isn't true.