Backup strategies you should test before you need them

We have yet to walk into a small business that says "we do not have backups". Almost every business we visit has some form of backup. What we have often not seen is a backup that has been restored. The restore test is the part of the backup strategy that small businesses skip, and it is the part that matters.

The 3-2-1 rule

The 3-2-1 rule is a simple discipline: keep three copies of your data, on two different media, with one copy off-site. Most small businesses we visit have the first two parts. The off-site copy is usually the part that fails. A USB drive on the shelf next to the server is not off-site. A cloud backup that has never been tested is off-site in theory but not in practice.

What we recommend

• Local backup to a NAS or external drive for fast restores of individual files.
• Cloud backup to a provider with Australian data residency, for off-site protection.
• Image backup of the server or virtual machine, so you can restore the whole system, not just files.
• Microsoft 365 backup if you use Exchange Online or SharePoint. The cloud provider's built-in retention is not a substitute for a separately tested backup.

The restore test

Once a quarter, we restore a random file from the cloud backup to a separate machine. We time it. We record it. If it fails, we find out why before a disaster. Most small businesses have never done this. The first time they try to restore is when the server has died and the practice manager is watching the clock.

Backup that has never been restored is not a backup. It is a hope. We test hopes so you do not have to.

Ransomware and the offline copy

Since ransomware attacks on small businesses became more common, we also recommend an offline or immutable copy. That means a backup that the ransomware cannot reach because it is not connected to the network. A cloud backup with object-lock, or a drive that is physically removed after each backup, both work. The point is that if an attacker encrypts your file server, they cannot encrypt the backup.

What to ask your current provider

If you pay someone for backup today, ask them three questions: where is the off-site copy, when was the last restore test, and do we have an offline copy for ransomware. If they cannot answer all three, the backup strategy is not finished.