Almost every business we talk to in the Fraser Valley says they have backups. Far fewer have ever tried to restore from one. A backup only matters on the worst day: a failed drive, a stolen laptop, a deleted folder or a ransomware attack. This guide covers what a backup that actually works looks like, and how to check yours.
Start with the 3-2-1 rule
The 3-2-1 rule is the simplest yardstick there is:
- 3 copies of your important data: the live copy plus two backups.
- 2 different types of storage, for example a local backup device and a cloud service.
- 1 copy off-site, so a fire, flood or break-in at the office does not take everything.
Many businesses now add a fourth rule: at least one copy that cannot be changed or deleted for a set period, often called immutable or air-gapped. That is the copy that saves you from ransomware, because the attacker cannot encrypt or erase it even with your admin password.
Microsoft 365 and Google Workspace are not your backup
Cloud email and file services are very reliable, but they are built to keep the service running, not to undo your mistakes. Deleted items and version history are kept for limited periods, and if a user, a sync error or an attacker deletes or encrypts files, those changes sync everywhere. A separate backup of mailboxes, OneDrive, SharePoint or Google Drive closes that gap.
Know what you are protecting
Make a short list of where your business data actually lives:
- Email and shared files
- Accounting and ERP data, such as Odoo, QuickBooks or Sage
- Line-of-business apps and their databases
- Laptops and desktops where staff save things locally, whether they should or not
- Website, domain and DNS settings
For each, write down two numbers: how much work you could afford to lose (a day? an hour?) and how quickly you need it back. Those answers decide how often you back up and what kind of backup you need.
Protect the backups themselves
- Use a separate login for the backup system, with multi-factor sign-in.
- Encrypt backups, especially anything leaving the office.
- Keep at least one copy immutable or disconnected.
- Under BC's PIPA you are responsible for personal information in your backups too, so know where they are stored. Many of our clients prefer Canadian data centres.
Test a restore, on a schedule
This is the step most often skipped. At least every quarter, pick something real and restore it: a single file, a mailbox, a full laptop or your accounting database. Time how long it takes and note anything that went wrong. A backup that has never been restored is a guess.
A five-minute self check
- Do you know where every backup is stored?
- Is at least one copy off-site and one copy protected from deletion?
- Are Microsoft 365 or Google Workspace backed up separately?
- Does someone get alerted when a backup fails?
- When did you last restore something, and did it work?
If any answer is "not sure", that is the place to start.
How we help
Bitlogix designs, monitors and tests backups for businesses across Mission, Abbotsford, Chilliwack, Langley and the Lower Mainland, with remote support anywhere in BC. If you would like a second opinion on your setup, book a free 30-minute consultation and we will walk through the self check with you.
Useful references
- Baseline cyber security controls for small and medium organizations, Canadian Centre for Cyber Security, which includes backup and recovery as a core control.
- Get Cyber Safe, Government of Canada: plain-language security tips for small businesses.
- Office of the Information and Privacy Commissioner for British Columbia: guidance on protecting personal information under PIPA.
Cover photo by Domaintechnik on Unsplash.