Backup & Recovery for Small Business
Section updated .
Small-business backup that survives ransomware has four parts: multiple copies kept apart (the 3-2-1 rule), at least one copy that is immutable or offline so an attacker cannot erase it, a restore test that proves the data comes back, and a recovery-time plan that says how long the business can be down. A backup that has never been restored is a hope, not a control.
Most ransomware attackers go after backups first, because a victim with a working backup does not need to pay. That makes the backup system itself a target: it is often reachable with the same administrator account the attacker has just stolen, and it is often never tested until the day it is needed.
The four guides here follow the order in which a small business usually finds the gaps: where the copies live, whether an attacker can delete them, whether they restore, and how long the whole recovery really takes.
Guides in this section
The 3-2-1 backup rule
Three copies, two kinds of media, one off-site, and how to count them honestly for cloud and SaaS data.
Read the guide →Immutable and offline backups
Why attackers delete backups first, and how to keep one copy that stolen admin credentials cannot erase.
Read the guide →Restore testing
A simple monthly test that proves files, mailboxes and systems actually come back.
Read the guide →Recovery-time planning
Recovery time and recovery point objectives in plain language, and a downtime plan an owner can approve.
Read the guide →How to work through this section
Start with the 3-2-1 rule to count your copies honestly. Then read immutable and offline backups to make one of them undeletable. Schedule a restore test, and use recovery-time planning to turn the result into a number the owner can act on. The restore-time tool does the arithmetic.
Monday is backup day in the daily briefing: run one restore test a month and review the copy count every quarter.
Frequently asked questions
What is the 3-2-1 backup rule?
Keep at least three copies of your data, on two different kinds of storage, with one copy held somewhere else. Many guides now add one immutable or offline copy and zero unverified backups.
Does Microsoft 365 or Google Workspace back up my data?
Both keep your data available and offer limited retention and recovery, but that is not the same as an independent backup under your control. Read the provider's retention terms and decide whether you need a separate copy.
How often should I test a restore?
At least monthly for a sample of files and at least yearly for a full system recovery. The restore-testing guide gives a checklist.
How long will recovery take?
It depends on data size, bandwidth and what must be rebuilt first. The restore-time tool gives a first estimate you can check against a real test.
Be first when the email edition starts
The briefing is published on this site every morning. The email edition is not sending yet — leave your address and you’ll be among the first told when it starts. Nothing is sent in the meantime.