Every business today runs on data: accounts, customer records, designs, contracts, emails and employee files. A failed hard disk, a stolen laptop, a fire, an accidental deletion or a ransomware attack can wipe out years of work in minutes. Businesses with reliable backups recover in hours or days; those without may never recover fully. Building a backup and disaster recovery plan is one of the most valuable IT investments a small or medium enterprise can make.
1. Know what you need to protect
- List critical data: accounting files, ERP and CRM databases, shared folders, email, designs and HR records.
- Identify where each is stored — computers, a server, cloud services, phones.
- Decide how much data loss is acceptable (recovery point objective) and how quickly systems must be back (recovery time objective).
2. Follow the 3-2-1 rule
Keep at least three copies of important data, on two different types of storage, with one copy off-site. For example: the live data on your server, a backup on a local backup device, and another copy in the cloud. Increasingly, businesses add an offline or immutable copy that ransomware cannot change.
3. Choose backup methods
- Local backups to a network storage device or external drives give fast restores.
- Cloud backups protect against fire, theft and site disasters.
- Cloud application backups for email and file-sharing services, because deletions and ransomware can affect cloud data too.
- Image backups of servers allow whole systems to be restored quickly.
Moving files to the cloud is often a good first step; see our cloud migration guide.
4. Protect backups from ransomware
Attackers increasingly try to delete or encrypt backups before launching ransomware. Keep backup systems on separate credentials with multi-factor authentication, use immutable or versioned storage, keep an offline copy and restrict who can delete backups. Network protections such as firewalls and segmentation, explained in our network security guide, reduce the chance of attack in the first place.
5. Test restores regularly
A backup is only useful if it can be restored. Schedule regular restore tests: recover a few files, a database and occasionally a full system. Check that backups are complete and that the team knows the restore steps. Monitor backup reports daily and fix failures immediately.
6. Write a simple disaster recovery plan
- Who declares a disaster and who leads recovery.
- Contact details for IT support, vendors and key staff.
- The order in which systems are restored, starting with the most critical.
- Where backups are and how to access them.
- How to communicate with customers and staff during an outage.
Keep the plan printed and stored off-site as well, because it may be needed when systems are down. Review it every year and after any major change.
7. Cover the physical risks too
Protect server rooms with proper power backup, cooling, fire detection and restricted access. Electrical safety and fire systems are covered in ATTPL Infra’s electrical installation guide. Business data such as customer records in ATTPL CRM and employee records in ATTPL WorkforceOS should be covered by the same backup policies. Data protection obligations are explained by ATTPL Legal.
8. Common backup mistakes
- Keeping the only backup drive permanently connected to the server.
- Never testing restores until a disaster happens.
- Backing up files but not databases, email or cloud applications.
- Letting backup failure alerts go unread.
- Depending on one employee who alone knows how backups work.
Document the backup setup and share it with at least two people so that recovery does not depend on a single person.
Frequently asked questions
How often should a business back up data?
Critical data should be backed up at least daily, and more often for systems that change constantly, based on how much data loss the business can accept.
Are cloud services already backed up?
Providers protect their infrastructure, but accidental deletion, account compromise or ransomware can still affect your data. A separate backup is recommended.
What is an immutable backup?
A backup copy that cannot be changed or deleted for a set period, which protects against ransomware and malicious deletion.
Need a backup and recovery plan? Contact ATTPL IT.
