The Small Business Data Backup and Recovery Checklist

Most small businesses think they have backups until the day they need one. This checklist walks you through what to protect, where to store copies, how often to run them and, most importantly, how to prove you can actually get your data back.

Close-up of an open computer hard disk drive showing the silver platter and read arm — Every drive fails eventually. A backup plan decides whether that day is an inconvenience or a crisis.

Key takeaways

Follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy kept off site.
Cloud apps are not automatically backed up in the way you think. Check what each provider actually restores and for how long.
Keep at least one copy that ransomware cannot reach, either offline or protected from deletion.
A backup you have never restored is a hope, not a plan. Test restores on a schedule.

Data loss rarely arrives with a warning. A laptop gets left in a taxi, a bookkeeper deletes the wrong folder, a power surge damages a server in the back office, or ransomware locks every file on the shared drive overnight. In each case, the question is the same: how quickly can you get back to work, and how much will you have lost?

The good news is that a reliable backup routine is neither expensive nor complicated for a small business. It does require a bit of upfront thinking and a habit of checking that it still works. Use the checklist below to build that routine, or to audit the one you already have. If you have already written a business continuity plan, treat this as the detailed data section that sits inside it. And because backups are one part of protecting your systems, pair this checklist with a broader cybersecurity checklist.

Why backups fail when you need them most

Most failed recoveries are not caused by a lack of backups. They are caused by backups that quietly stopped working, that missed important data or that were destroyed along with the original. The usual culprits look like this:

The job stopped months ago. A password changed, a drive filled up or a subscription lapsed, and nobody read the error emails.
The wrong things were protected. Documents were backed up, but the accounting database, email or the point of sale data were not.
The backup sat next to the original. An external drive plugged into the same computer is lost in the same fire, flood or theft, and it is encrypted by the same ransomware.
Nobody knew how to restore. The person who set it up has left and the process was never written down.

Common mistake

Treating file sync as a backup. Services that keep a folder identical across devices are excellent for collaboration, but if a file is deleted or encrypted on one device, the change can spread to every other copy. Version history helps, yet it often has time limits. A true backup is a separate copy that you control and can roll back to a point in time.

The 3-2-1 rule, explained simply

The most widely recommended starting point is the 3-2-1 rule, which appears in guidance from the US Cybersecurity and Infrastructure Security Agency (CISA) among many others. It is easy to remember and covers most small business risks.

3-2-1 Keep three copies of your data, store them on two different types of media, and keep one copy off site A long-standing rule of thumb recommended in CISA guidance

In practice, that could mean the working copy on your computers or cloud apps, a second copy on a local backup drive or network storage device, and a third copy with a cloud backup service in a different location. Many businesses now extend the idea to "3-2-1-1-0": one copy that is offline or immutable (it cannot be changed or deleted for a set period) and zero errors when you verify it. You do not need the jargon, but the two extra ideas are worth adopting.

Step 1: Make an inventory of your data

You cannot protect what you have not listed. Spend an hour writing down where your business data actually lives. Most small companies are surprised by how scattered it is.

Places data hides

Laptops and desktops, including the desktop and downloads folders people use as filing cabinets
Shared drives, network storage boxes and any server in the office
Cloud accounting, payroll, customer relationship and e-commerce platforms
Email accounts and calendars, including former employees' mailboxes
Your website, its database and its media library
Phones that hold customer photos, signed forms or messages
Design files, contracts and templates stored on personal accounts

Rank it by impact

For each item, ask two questions. How much data could you afford to lose, measured in time (an hour, a day, a week)? And how long could you operate without it? Those answers are known as your recovery point objective and recovery time objective. You do not need precise figures. A simple "critical, important, nice to have" label for each item will shape every decision that follows.

External hard drive resting on a wooden table beside a laptop in a home office — A local drive gives fast restores, but it only counts as one of your three copies.

Step 2: Choose where your copies live

Each storage option has strengths and weaknesses. Most small businesses end up combining two or three of them.

Option	Best for	Watch out for
External drive	Fast, cheap local copies of a few computers	Easy to forget, easy to lose, vulnerable if left plugged in
Network storage device	Offices with several computers and large files	Needs updates and its own off-site copy
Cloud backup service	Automatic off-site protection with version history	Slow full restores over a weak internet connection
SaaS backup tool	Email, file and app data held by cloud providers	Extra subscription; check which apps it supports
Offline or immutable copy	Protection from ransomware and accidental deletion	Needs a routine to rotate or refresh it

Pro tip

Read the data retention terms of every cloud app you rely on. Many providers protect against their own hardware failures but expect you to handle accidental deletion, departed users and malicious changes. If the terms say deleted items are kept for a limited number of days, that is your real safety window.

Step 3: Set the schedule

How often you back up should match how much work you could stand to redo. A design studio editing files all day might want continuous or hourly backups. A small consultancy that updates its records a few times a week may be fine with nightly jobs.

Critical systems: continuous or at least daily, with several weeks of versions kept.
Important files: daily, with versions kept for at least a month.
Archives and finished projects: after each change, plus a periodic full copy.

Retention matters as much as frequency. Ransomware and silent file corruption are often discovered days or weeks later. If you keep only the last few nights of backups, every copy may already be damaged by the time you notice.

Example

Suppose a five-person accounting practice keeps client files on a shared drive and uses a cloud bookkeeping platform. A sensible setup might be an hourly snapshot of the shared drive to a local storage device, a nightly cloud backup of that device to a different region, a third-party backup of email and cloud files, and a monthly export of key reports from the bookkeeping platform stored in the backup set. Once a quarter, the office manager restores a random client folder and a mailbox to confirm everything works.

Step 4: Protect the backups themselves

Backups hold a complete copy of your most sensitive information, so they deserve the same protection as the originals, or more.

Encrypt backups both in transit and at rest, and store the encryption key somewhere safe and separate.
Use separate login credentials for the backup system, protected with multi-factor authentication.
Disconnect local backup drives when not in use, or use storage that supports immutable, locked copies.
Limit who can delete or change backup settings to one or two trusted people.

Signs your backups are healthy

Someone reads backup reports every week
At least one copy is off site and one is protected from deletion
A test restore has succeeded in the past three months

Warning signs

Nobody is sure when the last backup ran
The only copy is a drive that stays plugged in
Restore steps exist only in one person's head

Step 5: Test your recovery

Testing is the step most businesses skip and the one that matters most. A restore test shows whether the data is complete, whether you have the passwords and keys you need, and how long recovery really takes.

Start small. Each month, restore a single file or folder chosen at random and open it to confirm it works.
Restore a system. Each quarter, restore a full mailbox, a database or a computer image to a spare machine or a test area.
Time it. Record how long the restore takes and compare it with how long you can afford to be down.
Use the written steps. Have someone other than the usual administrator follow the documented process, so you find the gaps.
Fix and repeat. Update the instructions, credentials or schedule based on what went wrong, then note the date of the test.

Step 6: Write a simple recovery runbook

A runbook is a short document that tells someone how to bring data back under pressure. Keep it to two or three pages and store a copy outside your normal systems, such as printed in a safe place or in a separate secure account.

Include who to call, where each backup lives, how to log in to the backup tools, the order in which systems should be restored and the contact details of any IT provider. Add the location of encryption keys without writing the keys themselves into the document.

Your backup and recovery checklist

List every place business data lives, including cloud apps and phones
Label each data source as critical, important or nice to have
Set up three copies on two types of storage, with one off site
Add one offline or immutable copy for ransomware protection
Back up email and cloud app data, not only local files
Match backup frequency to how much work you could afford to redo
Keep enough versions to roll back several weeks
Encrypt backups and protect backup logins with multi-factor authentication
Assign a named person to read backup reports weekly
Run a monthly file restore and a quarterly full system restore
Write a short recovery runbook and store a copy outside your systems
Review the whole setup once a year or after any major change

Frequently asked questions

Is cloud storage enough on its own?

Usually not. Cloud storage protects you from a broken laptop, but deletions, ransomware and account problems can affect the cloud copy too. Pair it with a separate backup that keeps independent versions.

How much does a small business backup setup cost?

Costs vary widely with the amount of data and the tools you choose. Many small teams can cover the basics with a local drive or storage device plus a cloud backup subscription. Compare the cost against the price of even one day of lost work.

Who should be responsible for backups?

Name one person, even if an outside IT provider does the technical work. That person checks reports, schedules restore tests and keeps the runbook current. Shared responsibility often turns into no responsibility.

How long should I keep old backups?

Keep enough versions to recover from problems you might not notice for weeks, and check whether laws or contracts in your industry require records to be kept for a set number of years. An accountant or lawyer can confirm the rules where you operate.

The bottom line

Good backups are boring, and that is the point. Follow the 3-2-1 rule, include your cloud apps, keep one copy out of reach of ransomware and test your restores on a calendar. An afternoon of setup and a few minutes each week can turn a potential business-ending event into a short, manageable delay.