Backup and Disaster Recovery for Small Businesses

Updated October 22, 2026

Every business owner believes they have backups. Far fewer have tested restoring from them. The difference shows up on the worst day: ransomware, a failed server, a flooded office, or an employee who deleted a shared folder three weeks ago.

Sync is not backup

The most common misunderstanding: “Our files are in OneDrive (or Dropbox, or Google Drive), so we’re backed up.”

Sync services copy changes everywhere, immediately. That’s great when a laptop dies. But if a file is deleted, overwritten, or encrypted by ransomware, the damage syncs too. These services do keep version history and a recycle bin for a limited time, which helps. But they aren’t designed as a backup, and an attacker with admin access can often empty them.

A real backup is:

• Automatic. Nobody has to remember.
• Separate. Stored where an attacker who compromises your network or Microsoft 365 account can’t delete it.
• Versioned. You can go back days or weeks, not just to last night.
• Tested. Someone has actually restored from it recently.

The 3-2-1 rule

A widely used rule of thumb:

• 3 copies of your data (the original plus two backups)
• on 2 different types of storage
• with 1 copy offsite

Many providers now add a “1” for an immutable copy: one that can’t be changed or deleted for a set period, even by an administrator. Immutability is the main defense against ransomware that goes after backups first.

Two numbers that matter: RPO and RTO

Recovery point objective (RPO) is how much data you can afford to lose, measured in time. If you back up nightly, your RPO is up to 24 hours of work.

Recovery time objective (RTO) is how long you can be down. Restoring a full server from a cloud backup over an office internet connection can take a day or more. A local backup appliance can bring a server back in under an hour.

Ask yourself: if our main system disappeared at 2 p.m. on a Tuesday, how much work would we lose, and how long until we’re working again? Then check whether your backup setup actually delivers those numbers.

What to back up

Don’t forget cloud software you pay for. If your CRM, accounting, or scheduling system is cloud-based, find out what its vendor backs up, for how long, and whether you can export your own copy.

A practical setup for a small office

For a typical 5–25 person office:

1. Microsoft 365 or Google Workspace backup with at least a year of retention.
2. If you have a server: image-based backups to a local device for fast recovery, replicated to the cloud with immutability.
3. No server: make sure everyone’s files live in SharePoint, OneDrive, or Google Drive (not on the desktop), and back up the cloud service.
4. Monitoring. Someone should get an alert when a backup fails, and act on it.
5. A quarterly restore test. Restore a few files and, at least once a year, a full system.

Disaster recovery is more than backups

Backups are your data. Disaster recovery is the plan for getting the business running again. A one-page plan should answer:

• Who declares a disaster and who do they call?
• Where do people work if the office is unusable?
• How do we reach employees and customers if email is down?
• What order do systems come back in?
• Where are the passwords and account details needed to restore everything (stored somewhere that doesn’t depend on the systems that failed)?

Central Virginia’s realistic disasters are mostly mundane: power outages from summer storms and hurricane remnants, a burst pipe, a failed server, and ransomware. Plan for those before you plan for anything exotic.

Questions to ask your IT provider

• When did we last successfully restore from backup?
• Are our backups immutable? Could an attacker with our admin password delete them?
• How long would it take to restore our main server or application?
• Are Microsoft 365 or Google Workspace backed up separately?
• Who gets alerted when a backup fails?