Almost every business we talk to in the Fraser Valley says it has backups. Ask when someone last recovered a file from one, and the answer is often never. A backup only matters on the worst day: a failed drive, a stolen laptop, a deleted folder or a ransomware attack. This guide covers what a dependable backup looks like, and how to check yours.
None of it needs an IT department. A reliable setup for a small business comes down to a few habits: keeping enough copies in the right places, protecting those copies, and proving every so often that they can be restored.
Start with the 3-2-1 rule
The 3-2-1 rule is a good yardstick. The numbers stand for three copies of anything important (the data you work on, plus two backups), held on two kinds of storage, such as a backup drive in the office and a cloud service, with one copy off-site. That way a fire, flood or break-in at the office cannot take every copy at once.
Many businesses now add a fourth rule: at least one copy that cannot be changed or deleted for a set period, often called immutable or air-gapped. That is the copy that saves you from ransomware, because the attacker cannot encrypt or erase it even with your admin password.
Microsoft 365 and Google Workspace are not your backup
Cloud email and file services are very reliable, but they are built to keep the service running, not to undo your mistakes. Deleted items and version history are kept for limited periods, and if a user, a sync error or an attacker deletes or encrypts files, those changes sync everywhere. A separate backup of mailboxes, OneDrive, SharePoint or Google Drive closes that gap.
Know what you are protecting
Before choosing a backup tool, make a short list of where your business data actually lives. For most small businesses that means email and shared files, accounting and ERP data such as Odoo, QuickBooks or Sage, and any line-of-business apps and their databases. Add the laptops and desktops where staff save things locally, whether they should or not, and your website, domain and DNS settings, which are easy to forget until something breaks.
For each, write down two numbers: how much work you could afford to lose (a day? an hour?) and how quickly you need it back. Those answers decide how often you back up and what kind of backup you need.
Protect the backups themselves
A backup is only useful if it survives whatever took out the original, and ransomware attacks often go after the backups too. Use a separate login for the backup system, with multi-factor sign-in, so a stolen everyday password cannot reach it. Encrypt backups, especially anything leaving the office, and keep at least one copy immutable or disconnected.
Under BC's PIPA you are responsible for personal information in your backups too, so know where they are stored. Many of our clients prefer Canadian data centres.
Prove it with regular restore tests
This is the step most often skipped. At least every quarter, pick something real and restore it: a single file, a mailbox, a full laptop or your accounting database. Time how long it takes and note anything that went wrong. A backup that has never been restored is a guess.
A five-minute self check
If you only have a few minutes, these five questions will tell you where you stand:
- Do you know where every backup is stored?
- Is at least one copy off-site and one copy protected from deletion?
- Are Microsoft 365 or Google Workspace backed up separately?
- Does someone get alerted when a backup fails?
- When did you last restore something, and did it work?
If any answer is "not sure", that is the place to start.
How we help
Bitlogix designs, monitors and tests backups for businesses across Mission, Abbotsford, Chilliwack, Langley and the Lower Mainland, with remote support anywhere in BC. If you would like a second opinion on your setup, book a free 30-minute consultation and we will walk through the self check with you.
Useful references
- Baseline cyber security controls for small and medium organizations, Canadian Centre for Cyber Security, which includes backup and recovery as a core control.
- Get Cyber Safe, Government of Canada: plain-language security tips for small businesses.
- Office of the Information and Privacy Commissioner for British Columbia: guidance on protecting personal information under PIPA.
Cover photo by Domaintechnik on Unsplash.