How to back up a small business server and prove the restore works

What counts as a backup

A backup is a copy kept apart from the original, so one failure does not take both[1]. A folder that syncs to another computer or a cloud drive often fails that test. Sync copies changes as they happen, including deletions and files that ransomware has locked. You wanted yesterday's folder. The sync gave you today's damage.

CISA, the U.S. cyber agency, says backups are your best hope of recovery from a ransomware attack[1]. Ransomware locks your files and asks you to pay. The copy that helps is an older one the attack could not reach, not a sync folder that followed the lock.

Start with a list of what to back up

Write down every place the business data lives. A typical office list looks like this:

• Shared files and project folders.
• Records that live in software, such as accounting, customer lists and scheduling.
• Email and calendars, if you hold them yourself. If a provider holds them, ask how long it keeps copies and whether you can restore a single message.
• The settings of the server itself, so a replacement can be set up the same way.
• A list of your accounts and who owns each one. Passwords stay off that list.

CISA starts the same way: inventory what is on the network, then protect first what the business cannot run without[1]. Mark whether each line sits on your server or another company holds the only copy. The second kind gets forgotten until that vendor's login stops working. Our list of what to gather is the page we fill in with you.

Keep three copies

Treat the three copies differently.

1. Your live data on the server. People work in this copy. It will be wrong sometimes, which is why the other two exist.

2. A second copy on separate storage in the same place. A network storage box or a second drive restores fast because it is close. It will not help if the room floods, or if the same login can wipe both.

3. A third copy that is offline or immutable. Offline means unplugged. Immutable means the copy cannot be changed or erased for a set time, even by someone with the password.

CISA describes the 3-2-1 rule: three copies, on two types of storage, with one copy off-site[1]. We keep that shape and add a condition. A disk in another building helps with fire and theft. A disk that stays connected and writable can still be reached by the same attack, so the third copy has to sit out of reach of the network. If you can only add one step this quarter, make that copy offline.

Why the offline copy matters

Verizon's 2025 Data Breach Investigations Report found ransomware in 88% of small business breaches, against 39% at larger organizations[2]. That figure describes breaches that already happened. It is not the odds your office will be hit this year. When a small-business breach is in that report, ransomware is usually part of it.

The same three copies cover the ordinary accidents we see more often than a ransom note: a deleted folder, a dead drive, a laptop left in a taxi with the only copy of a bid. You need a copy the accident did not touch, and someone who has restored from it once.

Pick a schedule you can keep

Ask how much work you can stand to redo. If losing a day would hurt a customer, back up every night. If losing a week is survivable, weekly can be honest. Write the choice down. An unwritten "we usually do it Sunday" is how a month goes missing.

Keep several older copies, not one file that overwrites itself. A spreadsheet damaged on Monday and noticed on Thursday needs a copy from before Monday. CISA advises testing that you can roll data back at least seven days[1].

CISA also advises encrypting backups and locking them up physically[1]. Encryption means the copy is unreadable without a key, so a stolen drive does not include the customer list in plain text. Keep the key somewhere other than on the backup itself.

Run the restore test

Most offices skip the restore test, and it is the only step that tells you the copies work. CISA advises scheduled recovery tests[1]. Run it with the person who owns the files:

1. Pick a few files and one record, meaning one entry in the accounting or customer software.

2. Delete a copy of them in a test folder only. Leave the only copy of anything alone.

3. Restore them from the backup, using the same steps you would use on a bad day.

4. Open them and check they match. Dates, totals and the awkward filename all count.

For the first test, restore onto a spare computer and let the person who uses the files choose which file. A file we pick tends to be one we already know is easy. Compare the restored file with the original and write down how long it took. A full recovery will take longer, so get that estimate in writing before you need it.

If the test fails, fix the cause and run it again. A copy job that reported success is not the same as a file you opened.

Write two things down

On one page, write where each backup lives and the date of the last restore test. A blank line means you do not yet know that you can recover. Test again after any change to how the backups run, then on a calendar you already keep. For a small office we suggest every quarter.

How the one-week install handles it

In the one-week install, backups are set up on day 3. The restore test runs on day 4 with you watching, and you sign acceptance only after a file comes back and matches. The handover record lists where the backup lives, including the offline copy. The written quote governs the days if your office needs a different order. Plan my install when you want that test done in the room.

Questions

Sources

1. CISA, Back Up Business Data. cisa.gov
2. Verizon, 2025 Data Breach Investigations Report snapshot. verizon.com