How should a small business back up its files?
Updated October 30, 2026
Keep at least one copy of everything you can’t afford to lose somewhere separate from your everyday accounts, so a fire, a theft, or a hacked login can’t reach it. Make it automatic, keep old versions long enough to notice a problem, and test a restore every few months. OneDrive, Google Drive, and Dropbox sync files, so a deletion or a ransomware-locked file syncs too. They help, but they aren’t the whole plan.
Steps
- List what you can’t lose: accounting, customer records, email, shared files, and the data behind your business software.
- Find where each one really lives: a laptop, a server or network drive, or a cloud account. That’s what you back up, not just the Documents folder.
- Back up cloud accounts with a separate service, so a problem in the account doesn’t take the copy with it.
- Copy computers and servers to an off-site or cloud backup that runs on its own, with nobody needing to remember.
- Give the backup its own logins, with multi-factor sign-in, so one stolen password can’t delete both your files and the copies.
- Choose how far back to keep versions: long enough to cover the weeks it can take to notice a problem.
- Send failure alerts to a shared mailbox, not one person, so they still reach someone after people leave.
- Test a restore every few months, and write down the date, what you restored, and whether it worked.
Details
What enough copies means
Enough means three copies of your data, on two kinds of storage, with one copy off-site. That’s the common 3-2-1 rule of thumb. Your working files count as the first copy, so you need two more. A sync folder like OneDrive can be the second, since it lives off-site. Because it changes whenever your files do, make the third a copy that doesn’t. Ideally that copy can’t be changed or deleted once it’s written, often called immutable, so ransomware or a hacked account can’t reach it.
Why cloud accounts need their own backup
Microsoft 365, Google Workspace, and QuickBooks Online keep the service running, which isn’t the same as keeping an independent copy of your data. Deleted items disappear after a limited time, a compromised account can delete things on purpose, and sync copies mistakes as faithfully as good changes. A separate backup service copies your mail, files, and shared sites into storage outside your account. For OneDrive specifically, see Does OneDrive back up my files?
Business software and servers need more than a file copy
Business software often keeps its data in a database somewhere other than your Documents folder, and copying a running program’s files can produce a backup that won’t open. Ask the software vendor how to back it up properly. For servers, use a backup that understands the system, not just a file copy.
Cloud or local? Usually both
The cloud-or-local question assumes one copy is enough. A local copy restores fastest, and an off-site copy survives a fire or a theft, so most small businesses keep one of each. If you can only have one, make it the off-site copy, because it covers the losses a local drive can’t.
How often, and how far back
Back up as often as the amount of work you’d be willing to redo. If redoing a day’s work is acceptable, daily is enough. Then decide how far back to keep versions. A file can be corrupted quietly, or ransomware can sit unnoticed, for weeks. Keep versions long enough to cover the time it might take to notice, and compare what a year of history costs before settling for a month.
Start early, because the first copy takes the longest
Setting up a backup takes an afternoon. The first full copy can take days over an office internet connection, and later copies only send what changed. Start it well before you need it, and check that the first copy finished.
How to test that a restore works
Restore a real folder to a different location and open the files, every few months. Note how long it took and who did it. Once a year, test something bigger, like a whole mailbox or laptop. A backup you’ve never restored is an assumption. How do I know if my business backups actually work? walks through the check.
What to leave out
You don’t need to back up what you can download again: Windows itself, installed programs, and files that already live in a backed-up system. Spend the effort on the data only your business has.
Where doing it yourself gets risky
- A backup that fails quietly, with its alerts going to someone who left.
- Backing up one folder while the real data lives somewhere else, like a business application’s database.
- Backup copies that the everyday admin account can delete. Ransomware goes looking for them.
- Assuming a software vendor is already doing it. Ask, and ask to see a restore.
Signs it’s time for help
It’s time for help when losing your data would cost more than backing it up properly. Signs it would:
- Your customer records, books, or project files would take weeks to recreate, or can’t be recreated at all.
- A day or two without them would cost you jobs, invoices, or customers.
- A client or an insurer expects you to show you can recover.
- You can’t say what a day of lost work costs, so you can’t tell whether your setup is enough.
This week, restore one real folder to a new location, open the files, and write down the date. If it doesn’t go smoothly, sort it out before the day you actually need those files.
Book a free 20-minute fit check