The small business backup solution I'd set up for you

The problem: "we have backups"

Almost every small business owner I talk to says it. And almost every time, the "backup" turns out to be one of two things: a USB drive that someone plugs in now and then, or a folder synced to Dropbox, OneDrive or Google Drive. Both feel safe. Neither is a small business backup solution.

Why the popular fixes fail

"Our files are in the cloud, so they're backed up." Sync is not backup. Sync copies every change, including the bad ones. Delete a folder by mistake and the deletion syncs. Get ransomware and the encrypted files sync, neatly replacing the good ones. Version history helps for a while, but it has limits and it lives in the same account an attacker just took over.

"We copy everything to a USB drive." Better than nothing, until you look closer. The drive sits plugged in, so ransomware encrypts it too. Or it lives in the same office as the computer, so a fire or a theft takes both. And the copy only happens when someone remembers, which in a busy month means never.

What both have in common: nobody has ever tried to bring the data back. So here is what I'd set up instead.

The 3-2-1 backup rule, made stricter

You may know the classic 3-2-1 backup rule. I use the stricter version:

• 3 copies of your data: the live one and two backups.
• 2 different kinds of storage, so one failure can't take both.
• 1 copy offsite, in case of fire, flood or theft.
• 1 copy that is offline or immutable, so ransomware can't reach it.
• 0 errors when you test a restore. A backup you haven't restored is a hope, not a backup.

What to back up (people forget half of it)

• Shared files and the file server, of course.
• Microsoft 365 backup or Google Workspace backup. Many owners assume Microsoft or Google keeps everything forever. They keep the service running; deleted or encrypted mail and files are your problem after the retention window.
• Databases for your accounting, POS or line-of-business app, backed up with the database's own tools, not just by copying files while it runs.
• Settings: router and firewall configuration, server configs, the list of software and licence keys. Rebuilding without these takes days.
• Laptops of people who keep work locally, whatever the policy says.

The setup I'd build for a ten-person office

1. A local backup every night to a small NAS or backup server in the office, for fast restores of everyday mistakes.
2. An encrypted offsite copy pushed to S3-compatible cloud storage, using open-source tools like restic or Kopia, so you aren't locked in to one vendor.
3. An immutable backup: that cloud bucket has object lock turned on, so nothing, not even an admin account, can delete those copies for 30 days.
4. A separate key and password for the backup system, written down and kept somewhere other than the office.
5. Monitoring that tells you when a job didn't run, rather than an email that says "success" every night.
6. A restore test every month, rotating through files, mail and databases, with a one-line log.

Ransomware recovery: the plan before the panic

When ransomware hits, people make bad decisions fast. Write the plan now, on one page:

• Who decides, and who you call first (your IT person, your insurer).
• Disconnect, don't switch everything off: keep evidence, stop the spread.
• Restore from the immutable copy onto clean machines, most critical systems first.
• Change passwords and check MFA before people log back in.

Print it. If the network is encrypted, the plan on the shared drive is encrypted too.

The mistakes I see most

• A USB drive that stays plugged in, which ransomware encrypts along with everything else.
• Backups that "completed" for months while copying an empty folder after a path change.
• An encryption key that only existed on the server that died.
• Nobody knowing how long a full restore takes until the day it matters.

Every one of these is found by a restore test. I wrote a separate, practical guide on exactly how to run one: backup restore testing in an hour a month. If you'd rather have someone set all of this up and keep it honest, that's what my backup and recovery work is.