Small Business Backup Solutions: A 3-2-1 Plan You'll Keep

Most small businesses have some kind of backup. Fewer have one that would actually get them running again after a dead server, a ransomware attack or a hurricane evacuation. The gap usually isn't the software. It's that nobody set it up around a plan, and nobody checks on it.

Here's a simple framework that holds up, and how we apply it for offices on Hilton Head and in Bluffton.

The 3-2-1 rule

The 3-2-1 rule has been around a long time because it works and it's easy to remember:

• 3 copies of your data. The original plus two backups.
• 2 different types of storage. For example, the server's own drives plus a separate backup device, or a local device plus the cloud. Two folders on the same drive don't count.
• 1 copy offsite. Somewhere a fire, flood, break-in or storm at your office can't reach.

Many businesses now add one more piece: at least one copy that can't be changed or deleted for a set period, even by someone with administrator access. More on why below.

Why sync is not backup

This is the misunderstanding we run into most. OneDrive, Dropbox, Google Drive and SharePoint are great for sharing files and working from anywhere. But they're built to keep every copy the same, which is the opposite of what a backup is for.

• Delete a folder on your laptop, and it's deleted everywhere.
• Ransomware encrypts the files on your computer, and the encrypted versions sync up and replace the good ones.
• Someone saves over a spreadsheet with the wrong data, and that version becomes the current one for everybody.

These services do have recycle bins and version history, and those can save you in a pinch. But they have time limits, they can be emptied, and they were never meant to be your only copy. A real backup is separate, keeps its own history, and isn't touched by what happens on your computers.

Microsoft 365 needs its own backup

If your business runs on Microsoft 365, your email, OneDrive files, SharePoint sites and Teams files live in Microsoft's cloud. Microsoft keeps the service running and protects against its own hardware failing. Protecting you from accidental deletions, a departing employee clearing out a mailbox, or a hacked account destroying files is largely on you.

Deleted items and recycle bins in Microsoft 365 only hold things for a limited time, and once that window closes, the data is gone. A separate Microsoft 365 backup service keeps its own copies of mailboxes, OneDrive, SharePoint and Teams, with history going back as far as you choose.

Ransomware is why history and immutability matter

Ransomware doesn't just encrypt the files on one computer. Attackers who get into a network often go looking for the backups first, because wiping out your backups is what pressures you to pay. A backup drive mapped to the server, or backups an admin account can delete, are often lost along with everything else.

Two features make the difference:

• Versioning. The backup keeps many past versions of each file, not just the latest. If files were encrypted on Tuesday, you restore Monday's copies.
• Immutability. Some backup storage can lock copies so they can't be changed or deleted until a retention period ends, even with the right password. That's the copy that survives when an attacker has admin access.

Backups are only one layer of ransomware protection. Endpoint protection on an enterprise-class security platform, multi-factor authentication and regular patching are the others, and our cybersecurity page covers them.

The hurricane question

Every business in the Lowcountry should answer this one: if there's a mandatory evacuation, what happens to your data?

An external backup drive sitting next to the server is not offsite. If water gets into the office, both go together. Even with no damage at all, an evacuation can keep you out of the building for days, and power outages can drag on after you're allowed back on the island.

A cloud copy changes that. If your files are backed up offsite (we use IDrive for cloud backup) and your email and documents are in Microsoft 365, you can keep working from a laptop wherever you evacuate to, and restore onto new equipment if the office hardware doesn't make it.

Before each hurricane season, confirm the cloud backup is current and that someone knows how to restore from it without being in the office.

What a typical small office should back up

For most of the offices we support, the list looks like this:

• The server or shared storage. The shared files, plus the server itself, so it can be rebuilt quickly. An image-level backup lets you restore the whole machine, not just files.
• Workstations. Ideally files live on the server or in OneDrive and SharePoint, but in practice desktops collect important things. Back them up too.
• Microsoft 365. Email, OneDrive, SharePoint and Teams, as covered above.
• Line-of-business application data. Accounting, scheduling, practice management or industry software. Find out where its database actually lives. Some keep it on the server, some on one particular workstation, and some are cloud services where you should know whether and how you can export your data.
• The things nobody thinks about. Firewall and network settings, software license keys, and a record of who has admin access to what.

Seasonal businesses should pay extra attention here. A computer that sits unused all winter may have missed months of backups without anyone noticing.

Test restores on a schedule

A backup you've never restored from is a guess. Backup jobs can report success while missing a folder, skipping files that were open, or quietly running out of space. The only way to know is to restore something.

• Monthly: restore a few random files and open them.
• Quarterly: restore something bigger, like a whole folder, a mailbox or an application database, and confirm it works.
• Yearly: walk through a full recovery, including how long it would take to get people working again.

Write down what you tested and what you found. That record also comes in handy for cyber insurance applications, which often ask about backups.

Keeping the plan from falling apart

Backups fail quietly. A drive fills up, a password changes, a new computer gets added and never enrolled. The plan only works if someone is watching it.

As part of our managed IT services, we set up the backups, keep an eye on the backup jobs alongside the monitoring we run on every managed computer, fix failures when they show up, and run the test restores so you don't have to remember.

If you'd rather handle it yourself, the checklist above is a solid place to start, and our data backup page explains how we set things up.

Let's look at your backups together

If you run a business on Hilton Head Island or in Bluffton and aren't sure your backups would hold up, we can review what you have and show you where the gaps are. Call (843) 422-2201 or reach out through our contact page.