Most business owners know they should have backups. Far fewer know exactly what is backed up, where it is stored and how long it would take to get everything back if the worst happened. Usually that question only gets answered during an emergency, which is the worst possible time to find out, and the reason a disaster recovery plan matters.
This guide covers a simple, widely used approach to backups and how to turn it into a recovery plan you can rely on.
What are you protecting against?
It helps to think about the different ways data can be lost, because each one affects how backups should be stored:
- Accidental deletion or mistakes, such as someone overwriting an important file or a botched website update.
- Hardware failure, such as a failed laptop drive or server.
- Ransomware and hacking, where attackers encrypt or delete data, sometimes including connected backups.
- Physical events, such as fire, flood or theft at your premises.
- Supplier problems, such as a hosting company or software provider closing your account or going out of business.
The 3-2-1 rule
The 3-2-1 rule is easy to remember and covers most of these risks:
- 3 copies of your data: the original plus two backups.
- 2 different types of storage, so a single kind of failure cannot affect every copy.
- 1 copy off-site, away from your premises and your main systems.
Many organisations now extend this further, adding a copy that is offline or “immutable”, meaning it cannot be changed or deleted for a set period. That protects against ransomware that tries to destroy backups as well as live data.
Photo by Pham Nhat on Unsplash
Applying it to your website
Website hosting often includes backups, but they are usually stored with the same provider. If your account is compromised or suspended, those backups may go too. A sensible website backup setup includes:
- Daily automatic backups of both the files and the database.
- A copy stored with a separate provider, such as cloud storage in a different account.
- Extra backups taken immediately before updates or major changes.
- Enough history, for example 30 days, to recover from problems that are not noticed straight away.
Applying it to business data
For files, email and business software, check what your providers actually back up. Cloud services such as Microsoft 365 and Google Workspace are very reliable, but their own retention of deleted items is limited, and a third-party backup is worth considering for important accounts. For any systems you run yourself, make sure backups are automatic and monitored, not dependent on someone remembering to plug in a drive.
Test your restores
A backup is only useful if it can be restored. Every few months, pick something and restore it: a single file, a mailbox or a full copy of your website on a test server. You will find out whether the backup is complete, how long recovery really takes and whether anyone other than one person knows how to do it.
Write a simple recovery plan
A disaster recovery plan does not need to be long. One or two pages covering the following is enough for most small businesses:
- Which systems matter most, and how quickly each needs to be back.
- Where the backups are and who has access to them.
- Step-by-step restoration instructions.
- Contact details for hosting, IT and software suppliers.
- How you will communicate with customers if services are down.
Store a copy somewhere you can reach even if your main systems are unavailable.
We set up and monitor backups as part of our hosting and maintenance work, and we can help you review the arrangements for your business systems too. If you are not sure your backups would save you, let’s check them together.
