Most offices have some kind of backup running. Far fewer have ever tried to get a file back from it. That's the part that matters: a backup you can't restore from is just a reassuring status light.

Backups fail quietly. A drive fills up, a password changes, a new folder never gets added to the backup, or the backup software stops after an update. Nothing warns you until someone needs a file that isn't there.

Know what you're backing up

Start with a list of where your important data actually lives:

  • The office file server or shared drive.
  • Each computer's desktop and documents folders, if people save files there.
  • Accounting, practice management, or line-of-business software and its database.
  • Email and cloud files in Microsoft 365 or Google Workspace.

Cloud services keep your data available, but they aren't a full backup. Deleted items are only kept for a limited time, and a deletion or ransomware attack that syncs to the cloud can take the cloud copy with it.

Follow the 3-2-1 rule

A simple standard that holds up well:

  • 3 copies of important data: the original plus two backups.
  • 2 different types of storage, such as a local backup drive and a cloud backup service.
  • 1 copy offsite, so a fire, theft, or ransomware attack in the office can't reach it.

A backup drive that's always plugged into the server is convenient, but ransomware can encrypt it along with everything else. The offsite copy is what saves you.

Test a restore

Pick a date each quarter and do this:

  1. Restore a few real files. Choose files from different places, including one from a few weeks ago, and open them to make sure they work.
  2. Check the dates. Confirm the most recent backup is from when you expect, not three months ago.
  3. Restore something big. Once a year, try restoring a whole folder or a full system to a spare machine, and time it. If it takes two days, you want to know that now.
  4. Write it down. Note what you tested, when, and whether it worked.

Watch the alerts

Most backup software can email someone when a backup fails. Make sure those emails go to a person who reads them, not to a mailbox nobody checks, and that someone acts when one arrives.