Most small businesses do not think about backups until the day they need one: a laptop is stolen, a staff member deletes a folder, ransomware encrypts the shared drive, or a cloud account is locked. On that day the question is simple: can you get your data back, and how long will it take? Studies of small business failures consistently show that data loss is a leading contributor to serious disruption, and the cheap insurance is a backup routine that someone has actually tested. This guide gives you a practical plan without jargon. You will learn what data to protect, how the 3-2-1 rule works, how to handle data that lives in cloud services (which people wrongly assume is backed up), how to automate and encrypt backups, how to test restores and what to do in an emergency.
Step 1: List what you must not lose
| Category | Examples | Where it lives |
|---|---|---|
| Financial records | Invoices, accounting data, tax documents | Accounting software, laptops, email |
| Customer data | Contacts, orders, bookings, conversations | CRM, booking system, chat tools |
| Documents | Contracts, proposals, price lists, policies | Shared drives, laptops |
| Website | Pages, images, database, settings | Hosting provider, CMS |
| Mailboxes and attachments | Email provider | |
| Configuration | Passwords, DNS records, licence keys | Password manager, registrar |
Rank them by how painful the loss would be. Start by protecting the top three.
Step 2: Understand the 3-2-1 rule
- 3 copies of your data: the original and two backups.
- 2 different types of storage, for example an external drive and cloud storage.
- 1 copy off-site, away from your office, so a fire, flood or theft cannot destroy everything.
Modern advice adds a fourth idea: keep at least one copy that cannot be changed or deleted from your normal computers, called an immutable or offline copy. Ransomware often encrypts every connected drive, including backups, so an isolated copy is your last line of defence.
Step 3: Do not assume the cloud is a backup
Cloud services keep your data available, but that is different from protecting it. If someone deletes a record, if a sync error overwrites files or if ransomware syncs encrypted files back to the cloud, the service faithfully keeps the damage. Most software-as-a-service providers operate on a shared-responsibility model: they keep the service running, and you are responsible for your content.
| Service type | Backup approach |
|---|---|
| Email and shared drives | Third-party backup tools, or scheduled exports |
| Accounting and CRM | Regular exports to CSV or the tool's export function; keep the files |
| Website | Host backups plus your own periodic copy of files and database |
| Booking and chat tools | Export contacts, bookings and knowledge documents regularly |
| Password manager | An encrypted export stored offline |
Always confirm that any tool you rely on lets you export your data; see how to choose SaaS software.
Step 4: Choose your tools
- For laptops and desktops, use the operating system's built-in backup to an external drive, plus an automatic cloud backup service.
- For servers or a shared drive, use a network storage device with snapshots and replicate to the cloud.
- For cloud accounts, use a reputable backup service that supports them, or scheduled exports.
- For an offline copy, rotate an encrypted external drive kept off-site, or use immutable cloud storage.
Pick tools that run without anyone remembering. A backup that depends on a person clicking a button will eventually stop.
Step 5: Automate and encrypt
- Schedule daily backups for changing data and weekly for the rest.
- Encrypt backups so a lost drive is not a data breach.
- Store encryption keys and passwords separately from the backups, in a password manager and a sealed printed copy.
- Set alerts for failed backups and check them.
For customer personal data, an unencrypted backup drive that goes missing can be a reportable breach in many places. See the GDPR checklist.
Step 6: Decide how much loss you can tolerate
| Term | Meaning | Example |
|---|---|---|
| Recovery point objective (RPO) | How much recent data you can afford to lose | One day of bookings |
| Recovery time objective (RTO) | How long you can be without the system | Four hours for the booking system, two days for old archives |
These two numbers determine how often you back up and how quickly you need to restore. A clinic that cannot lose appointments needs more frequent backups than a business with a static brochure site.
Step 7: Test a restore
An untested backup is a hope, not a plan. Every quarter, pick a file, a mailbox item and one system export and restore them to a different location. Time the process and note any problems. Once a year, rehearse a bigger scenario: a laptop is lost, and a staff member needs to be working again on a spare machine by the end of the day.
Step 8: Write a one-page recovery plan
- Who to call and in what order.
- Where the backups are and how to access them, including passwords.
- The order in which to restore systems.
- How to contact customers if service is disrupted.
- Which accounts to lock and which passwords to change after an incident.
- Where the printed copy of this plan is kept.
Keep a copy outside the systems it describes, since you cannot read an online document if your accounts are down.
Protecting against ransomware
- Keep an offline or immutable backup.
- Enable two-factor sign-in everywhere; see team roles and two-factor authentication.
- Keep systems updated.
- Train staff to spot phishing.
- Limit who can delete or overwrite shared files.
A simple starter setup
| Item | Suggested setup | Frequency |
|---|---|---|
| Laptops and desktops | Automatic cloud backup plus an external drive | Continuous or daily |
| Shared documents | Version history plus a weekly export to a second location | Weekly |
| Accounting and CRM | Export to CSV and store in the backup location | Monthly, and before big changes |
| Website | Host backups plus a copy of files and database | Weekly, and before updates |
| Passwords and DNS records | Encrypted export stored offline | After every change |
Assign one person to own the backup routine and one deputy, so it does not depend on a single individual. Put a recurring reminder in the calendar for the quarterly restore test, and write down the result each time. If a restore fails, treat it as the most valuable thing the test could have found, fix it that day and test again.
Frequently asked questions
What is the 3-2-1 backup rule?
Keep three copies of your data, on two different types of storage, with one copy off-site.
Is Google Drive or Dropbox a backup?
Not by itself. They sync changes, including deletions and encrypted files, so add a separate backup or version history you have tested.
How often should I back up?
Daily for data that changes daily, weekly for the rest. Decide based on how much loss you can tolerate.
Do I need to encrypt backups?
Yes, especially if they contain customer data and could be lost or stolen.
How do I know my backup works?
Test a restore every quarter and time it.
Are the tools I use for customer chats and bookings included?
Check each tool's export options and export your contacts, bookings and documents regularly.
Crescelo lets you keep your own copies of your source documents; see the knowledge base feature and pricing. For a related process, read preparing your service menu and price list.
Further reading
- Google Search Central: creating helpful, people-first content: What Google looks for in useful pages.
VASTAA JOKAISELLE KÄVIJÄLLE. VARAA AIKA NIILLE, JOTKA OVAT VALMIITA.
Ota Crescelo käyttöön verkkosivustollasi 15 minuutissa
Opeta avustajasi hinnastoillasi, asiakirjoillasi ja palveluehdoillasi. Ota käyttöön lähteisiin perustuvat vastaukset ympäri vuorokauden ja päällekkäisyydettömät ajanvaraukset suoraan chatissa.