If you ask people when they last thought about backing up their business data, most will say “never.” If you ask who has a backup, they’ll say “we do” - and then you find out that “we do” means “there’s a file on a USB drive in a drawer somewhere” or “OneDrive is syncing our documents folder.”

Neither of those is a backup.

The reason most businesses discover they need backups when it’s too late isn’t because they didn’t care. It’s because data loss is the kind of problem that feels impossible until it happens to you. You think about it the way you think about car accidents - you’d never want one, but until it happens, you focus on the driving, not the insurance.

What Actually Counts as a Backup

A real backup has three characteristics:

1. It’s stored separately from your primary data. If your computer’s hard drive fails, the backup is unaffected.
2. It’s versioned. It keeps multiple copies from different points in time so you can restore from before a problem occurred.
3. It’s tested. You can prove it works by actually restoring from it.

OneDrive syncing is not a backup. If you delete a file from OneDrive, it’s deleted from the backup. If ransomware encrypts your files and syncs them to OneDrive, the encrypted versions are in the backup too. That’s synchronization, not backup.

An external hard drive that you manually copy files to once a month is closer, but the manual part is the weak link. If you forget, or if the drive fails and you don’t notice, you don’t have a backup.

The Three Ways Small Businesses Lose Data

Hard drive failure. Every hard drive eventually fails. It’s not a question of if, it’s a question of when. When it does, any data not backed up is gone.

Ransomware. This is the scenario that keeps business owners up at night. Someone clicks a phishing link, the ransomware encrypts every file on the computer, and now the business can’t operate. The only way to recover is from a backup that predates the infection.

Human error. An employee deletes a shared folder. Someone overwrites a critical spreadsheet with an empty version. A contractor disconnects the wrong cable. These happen every day, and they’re actually the most common cause of data loss.

The 3-2-1 Rule

The industry standard for backup is the 3-2-1 rule: keep 3 copies of your data, on 2 different types of storage, with 1 copy offsite.

Three copies means your original data plus two backups. Two types of storage means something like a local drive and a cloud service - if one type fails, the other is still intact. One offsite copy means data that’s physically separate from your business, so a fire or flood at your location doesn’t destroy everything.

For a small business, this usually looks like:

• Original data on the computer or network storage
• A local backup on an external drive or NAS device
• A cloud backup service that stores encrypted copies offsite

The local backup gives you fast restores. The cloud backup protects against site-level disasters. Together, they cover almost every scenario.

Why This Is Harder for Small Businesses Than It Sounds

Setting up proper backups isn’t just buying a hard drive. You need to decide what to back up, how often, how long to keep copies, and how to verify everything is working. You need to handle the human factor - making sure backups run automatically and nobody has to remember to do something manual.

And then you need to test. A backup that fails silently is worse than no backup at all, because you think you’re protected when you’re not. Regular restore tests are the only way to know.

What Should Happen

Every small business should have:

• Automated backups running daily on every computer and server
• At least one offsite (cloud) backup
• A documented process for restoring data
• A quarterly test of the restore process

The cost of this for a typical small business is usually less than $100/month across all computers. The cost of losing data is measured in days or weeks of lost work, not dollars.

If you’re not sure what your current backup situation looks like - how many copies you have, where they’re stored, whether they’ve been tested - that’s a conversation worth having. A single remote session is enough to audit your setup and build a plan that actually works.