Handbook / Running the week
Data backup for small businesses: a simple, tested plan
A failed laptop, a stolen phone, an accidental deletion or a ransomware attack can wipe out client files, invoices and years of records in an instant. For a small business, a good backup is often the difference between a bad afternoon and a lost business. Backups are simple to set up, but only useful if they actually work when you need them.
What CISA advises
CISA's guidance for small businesses tells owners to perform and test backups. It notes that many organizations that fell victim to ransomware either had no backups or had incomplete or damaged backups. It says scheduling backups is not enough: it is critical to regularly test partial and full restores, pick a backup cadence, and write a plan for restoration.
Step 1: list what matters
Make a list of what your business cannot lose:
- client files and work in progress
- contracts, proposals and correspondence
- invoices, bookkeeping files and tax records
- photos, designs, code or other creative work
- website files and databases
- password manager vault and recovery codes
- email and calendar
- business documents, such as formation papers and licenses
Include data in cloud apps, not only on your computer.
Step 2: keep multiple copies
A widely used rule of thumb is to keep several copies on different types of storage, with at least one away from your main location. For a small business, that might mean:
- the original on your computer or cloud workspace
- an automatic cloud backup to a separate service
- a local backup to an external drive, disconnected when not in use
Step 3: protect against ransomware
Ransomware can encrypt anything your computer can reach, including connected drives and synced folders. Protect at least one copy by:
- keeping an external drive disconnected except during backups
- using a backup service with version history and protection against deletion
- turning on multifactor authentication for backup accounts
CISA's StopRansomware site has more resources.
Step 4: automate
Manual backups get forgotten. Set up:
- continuous or daily automatic backup for your computer
- version history on cloud storage
- scheduled exports from critical apps, where available
- reminders to connect your external drive weekly
Choose a cadence based on how much work you could afford to redo.
Step 5: test restores
At least every few months:
- restore a single file
- restore a full folder
- check that files open correctly
- time how long a full restore would take
Write down anything that did not work and fix it.
Step 6: write a restore plan
A one-page plan helps under stress:
- where each backup is and how to access it
- which accounts and passwords you need, stored in your password manager
- the order to restore things
- who to contact for help, including your insurer if you have cyber insurance
Keep a copy somewhere you can reach if your main computer is gone.
Cloud apps and email
Cloud services are reliable, but they do not always protect you from your own mistakes, a compromised account or a provider closing your account. Check:
- how long deleted items are kept
- whether version history is available
- whether you can export data regularly
For critical services, such as bookkeeping or client portals, export data periodically.
Records and retention
Backups also support your record keeping. The IRS expects you to keep records for set periods; see how long to keep records. Make sure your backup approach keeps older years safely, not just the latest version.
Devices and security
- encrypt laptops and phones
- keep software updated
- use a password manager and multifactor authentication
- have a plan for lost or stolen devices
Client data
If you hold client data, check your contracts for backup, retention and deletion requirements. Delete client data when it is no longer needed and the contract allows.
A quick monthly check
- confirm the last backup date on each system
- connect the external drive and run a backup
- restore one random file
- check storage space on backup services
When you replace a device
Before you retire an old computer or phone, confirm that everything is backed up and restorable on the new device. Then securely erase the old device before selling or recycling it, so client and business data does not leave with it.
List what you cannot lose, keep several copies including one offline or protected, automate backups, test restores regularly as CISA advises, and keep a one-page restore plan.
Questions people ask
Isn't cloud storage already a backup?
Not always. Sync services copy deletions and changes too. Check whether your service keeps version history and deleted files, and consider a separate backup.
How often should I back up?
As often as you can afford to lose work. Continuous or daily backups suit most active businesses.
Do I need to back up email and cloud apps?
Often yes. Check each provider's retention and recovery options, and export or back up critical data separately.
How do I protect backups from ransomware?
Keep at least one copy offline, or use backups that cannot be changed or deleted for a period, and protect backup accounts with multifactor authentication.
Do this week
- List the files, accounts and systems your business relies on.
- Turn on automatic backups for computers and key cloud services.
- Keep one backup offline or protected from deletion.
- Test restoring a file and a full folder this month.
- Write a one-page restore plan with logins stored securely.
Sources read for this page
Published November 8, 2026. Sources checked November 8, 2026. Rules, limits and forms change; the linked page is the authority.