Almost every business has backups. Far fewer know whether they work. The usual story: a laptop dies, a ransomware note appears, someone deletes a shared folder, a cloud account is locked, and only then does anyone try to restore. Sometimes it takes an hour. Sometimes the backup turns out to be empty, months old, or sitting on the same disk that just failed. This checklist helps you find out which kind of business you are before that day.
What counts as a backup
A backup is a separate, restorable copy of your data, kept somewhere a single mistake or attack cannot reach. Three things that are not backups:
- Sync folders. If a file is deleted or encrypted, the sync service copies that change everywhere.
- A second copy on the same machine or in the same room. Fire, theft and power surges take both.
- RAID or mirrored disks. These protect against a disk dying, not against a deletion or a virus.
Step 1: list what you would miss
Write down everything the business cannot work without. Walk through a normal week to find it.
- accounting and invoicing data;
- your ERP, job tracking or order system, and its database;
- customer records, whether in a CRM, a sheet or someone's email;
- email and calendars;
- shared files: quotes, drawings, contracts, photos;
- your website: files, database and the domain settings;
- data held in online services that you assume is safe because it is online;
- machine programs and settings on the shop floor, such as CNC programs and controller parameters;
- laptops and phones that hold the only copy of something;
- passwords and recovery codes.
Next to each item, write who owns it and where it lives. The surprises on this list are the real value of the exercise.
Step 2: apply the 3-2-1 rule
The rule is old and still sound.
- 3 copies of the data: the original and two backups.
- 2 different kinds of storage, such as a local disk and a cloud service.
- 1 copy off site, away from your building and your main account.
Add one more habit: at least one copy that cannot be changed or deleted from your normal login, either offline or stored with a setting that blocks deletion for a set period. Ransomware goes after backups it can reach.
Step 3: decide how much you can lose, and how long you can wait
Two questions, answered in plain language for each item on your list.
- How much work can we lose? If the last backup was last night, you can lose up to a day of entries. If that is too much for your order system, back it up more often.
- How long can we be without it? If invoicing can wait a day but the order system cannot wait an hour, they need different arrangements, not the same nightly job.
Write the answers in a small table. These two numbers decide how often to back up and how fast the restore has to be.
| Item | Most we can lose | Longest we can wait | |---|---|---| | Order system | Fill in | Fill in | | Accounting | Fill in | Fill in | | Shared files | Fill in | Fill in |
Step 4: automate, and make failure visible
A backup that depends on someone remembering will stop. Set it to run on a schedule, and set it to tell you.
- A success or failure message goes to a person, not an inbox nobody reads.
- You receive a short report on a schedule, so silence does not read as "all fine."
- Someone is named as responsible, with a backup person.
Step 5: protect the copies
- Encrypt backups, and store the key somewhere other than the backup itself.
- Limit who can delete them. Not everyone with access to the files needs access to the backups.
- Use two-step sign-in on the backup account and on the cloud storage account.
- Keep the recovery instructions where you can find them with your systems down: printed, or in a separate account.
Step 6: practice the restore
This is the step most people skip, and the one that matters most. A backup you have never restored is a hope.
- Pick one item from your list, ideally something important.
- Restore it to a different place from the original, not over it.
- Open it and check it is complete and current. Open files, run a report, look at the latest entries.
- Write down how long it took and what went wrong.
- Repeat for a different item every quarter, and for a full system at least once a year.
If you do only one thing from this guide, do this. You will find a missing folder, an expired password or a step nobody wrote down, and finding it on a quiet Tuesday is cheap.
Step 7: decide how long to keep things
Some data you need for years because of tax or contract rules. Some you want deleted. Keep several generations, such as daily copies for a month and monthly copies for a year, so that a problem noticed late can still be undone. Ask your accountant and read your client contracts for any minimum or maximum period.
The checklist
Print this and tick each line that is true today. Each line reads as a statement.
- I have a written list of what the business cannot work without.
- Each item has an owner and a known location.
- Each item has at least three copies, on two kinds of storage, one off site.
- At least one copy cannot be deleted or changed from a normal login.
- Backups run on a schedule without anyone remembering.
- Failures send a message to a named person.
- Backups are encrypted and the keys are stored separately.
- The backup account uses two-step sign-in.
- I have written down how much data I can lose and how long I can wait.
- Machine programs and settings on the shop floor are included.
- I restored a file or system from backup in the last three months.
- The restore steps are written down and stored where I can reach them with systems down.
- Retention periods match what tax and contracts require.
- When someone leaves, their access to backups and storage is removed the same day.
- Cloud services I rely on have their own export or backup, not just the provider's promise.
Reading your result
Fewer than ten ticks means you probably have at least one gap that a bad day would find. The first three to fix are usually the restore practice, the off-site copy and the failure alerts.
Next step: a 15-point check
We run the systems we build with backups and recovery tests, and we offer a 15-point backup, access and patching check for businesses that want a second opinion on theirs. It looks at the same ground as this checklist, plus who has access to what and how quickly your systems get patched.
Read more on the hosting and security page, or ask for the check through the contact form.