How should a small business back up its data?

Ascent Vision · Published October 28, 2026

A small business should back up whatever it could not easily recreate, not only its website: customer records, accounting, email, documents and tool settings. The 3-2-1 rule, which CISA calls a trusted guideline, is a good guide: 3 copies, on 2 types of storage, with 1 copy off-site. Choose backups that run automatically, test that you can restore from them, and name one person who checks that the latest backup actually ran.

What to back up

CISA advises starting with an inventory of the important information on your network, and says a simple spreadsheet can help you track what you are backing up. The data it lists includes customer and client records, employee and HR information, financial and payroll data, emails and critical communications, configuration files and software settings, and website and operational databases.

Beyond CISA's list, this is general advice. Small businesses often forget these, so ask where each one lives and who holds the copy:

Accounting, booking and customer tools that run in a vendor's cloud, where the vendor's copy is not necessarily a copy you can reach.
Documents kept in one person's own account or on one laptop.
Phone settings, such as call forwarding and the voicemail greeting, and who the number is registered to.
The settings of your website, email and tools.

The 3-2-1 rule

CISA calls the 3-2-1 rule "a trusted guideline". It means 3 copies of important files, on 2 different types of storage (its examples are a hard drive and the cloud), with 1 copy stored off-site, away from your business location. It also advises choosing a backup solution that "runs automatically and regularly". As general advice, a backup that depends on someone remembering can lapse. CISA also advises protecting backups with physical security, encryption and offline copies. As general advice, a folder that syncs to the cloud is not a backup by itself, because a deleted or damaged file can sync too.

CISA cites Verizon's 2025 Data Breach Investigations Report as finding that ransomware figured into 44% of the breaches Verizon investigated, and calls backups your best hope of recovery from a ransomware attack.

Test the restore, and make sure someone checks

CISA's advice is to test your backup procedure so that your team can restore data both fully and partially, and to be able to roll back data at least seven days if needed. It adds that a backup plan is only helpful if everyone knows how to use it.

The following is general advice. A backup that runs but cannot be restored gives little protection, so a plan needs a person, not just a tool:

Name one person who is responsible, and one backup person.
Have that person look at the date of the latest backup of each system on a set day each month, and ask for an alert when a backup fails.
Restore one file and one record from each system at set times, and write down how long it took.
Keep the restore steps where the owner can reach them.

What to ask a vendor

What exactly is backed up, and what is not?
How often does it run, and where are the copies kept?
How far back can you restore, and can you restore one item rather than everything?
Is the backup tested, and can you see the result?
Who is told when a backup fails, and how fast?
Can you export your data in a form you can use elsewhere, and what happens to the backups if you end the agreement?

Where the website fits

The related answer on what website maintenance involves and the related answer on what to look for in website hosting cover the website alone. The related answer on managed IT support covers an outside provider who looks after accounts and backups under an agreement.

Sources

CISA, "Back Up Business Data"

Ongoing technical support

The site goes down, email stops arriving, a domain is about to lapse, nobody knows the password. Many owners do not have a technical person. We are that person, for everything we build and the things you already have.

See the service Work with us