Backing Up Your Business Data

Why this matters

The day you find out your backups do not work is the day you needed them. A failed hard drive, a stolen laptop, a ransomware attack, or a fat-fingered delete can erase your customer list, your job history, your invoices, and your financials in an instant. A shop can survive a slow month. It cannot easily survive losing every record of who it works for and who owes it money. Backups are cheap insurance against a loss that would otherwise end the business. The catch is that most shops think they have backups when they actually have a vague hope, and hope does not restore.

What you cannot afford to lose

Start by naming what would actually hurt, because that is what the backup has to cover.

• Customer records: names, addresses, contact info, service history, access notes. Your relationship with every customer lives here.
• Financial records: invoices, payments, who owes what, your accounting. Lose this and you cannot even tell who to bill.
• Job and estimate history: what you did, what you quoted, photos and documentation. Your evidence and your institutional memory.
• Anything required for taxes or a dispute. Records you are legally expected to keep.

If you cannot picture rebuilding one of these from scratch, it needs a backup. Most of them you could not rebuild at all.

The rule that prevents disasters

There is a simple, battle-tested standard worth following: keep three copies of your data, on two different kinds of storage, with one copy off-site. People call it the three-two-one rule.

• Three copies: the live version plus two backups. One backup is not enough, because the backup can fail too.
• Two types of storage: not both on the same drive or the same machine. If they share a failure, they are one copy, not two.
• One off-site: at least one copy somewhere physically separate, so a fire, theft, or flood at your shop does not take the data and its backup together.

The off-site copy is the part shops skip and the part that saves them. A backup sitting next to the computer it backs up burns in the same fire.

Off-site usually means the cloud, and that has rules too

For most small shops the off-site copy is a cloud backup: your data, encrypted and stored on a provider's servers somewhere else. It is the easiest way to get a real off-site copy without driving a drive to another building.

• If your main software is already cloud-based, confirm the provider backs it up, and confirm you can get your data out. "It is in the cloud" is not a backup if you cannot export it. See related: Cybersecurity Basics for a Small Shop.
• Make sure it is encrypted, so the off-site copy is not a privacy leak. You are sending customer data off-site; protect it.
• Do not rely on a single cloud account as your only copy. If that account is compromised or closed, you are back to one point of failure. The cloud is the off-site copy, not the whole plan.

Automatic beats manual, every time

The backup that depends on a person remembering is the backup that is not running when you need it. Any backup that requires someone to plug in a drive every Friday will be weeks stale the day disaster hits, because life got busy and nobody plugged it in.

• Set it to run on its own, on a schedule, with no human step.
• Match the frequency to how fast you create data. If a day of lost work would hurt, back up at least daily.
• Get an alert if it fails. A backup that silently stopped two months ago is the cruelest kind. You want to know the day it breaks, not the day you need it.

Automatic and monitored is the whole difference between a backup that protects you and a backup that betrays you.

The step everyone skips: test the restore

A backup you have never restored from is a guess, not a safety net. The only proof a backup works is putting data back from it. Plenty of shops have discovered, at the worst moment, that their backups were corrupt, incomplete, or never actually ran.

• Do a test restore on a schedule, at least a couple of times a year. Pull a file or a record back from the backup and confirm it is real and complete.
• Confirm you can restore the things that matter, not just that the backup exists. The customer list and the financials, specifically.
• Time it. Knowing how long a restore takes tells you how long you would be down. That number should not be a surprise during an actual outage.

An untested backup is a story you tell yourself. A tested one is insurance you have seen pay out.

The mental model to keep

Backups are insurance you hope to never claim, and like any insurance, they are worthless if they do not pay out when you file. Three copies, two kinds of storage, one off-site, running automatically, monitored for failure, and proven by a real test restore. Get those right and a dead drive or a ransomware lock becomes an annoyance instead of the end of the business. The shop that tests its restore sleeps fine. The one that assumes finds out the hard way.

References

• Cybersecurity and Infrastructure Security Agency (CISA), data backup and recovery guidance
• U.S. Small Business Administration (SBA), preparing for and recovering from disasters
• Trade-standard practice for the three-two-one backup rule
• See related: Cybersecurity Basics for a Small Shop; The Customer Data You Store: Protecting It