How to build a small business backup plan

For a small business, losing data can mean losing invoices, customer records, and days of work, and sometimes the business itself. A backup plan doesn't need to be complicated, but it does need to be deliberate. Follow these seven steps to build one that you can actually rely on.

Step 1: Inventory your data

List where your business data lives. Most small businesses have more locations than they expect:

• Computers and laptops: documents, downloads, and desktop files.
• Servers and NAS devices: shared drives, line-of-business apps, and databases.
• Cloud apps: email, files, and chat in services like Microsoft 365 or Google Workspace.
• Business software: accounting, CRM, and point-of-sale systems, including their exports.
• Websites: site files and databases.

Step 2: Rank what matters most

Not all data is equally urgent. Sort it into tiers, for example:

• Critical: you can't operate without it (accounting, orders, customer data).
• Important: needed within a few days (project files, shared documents).
• Nice to have: archives and reference material.

Step 3: Set your RPO and RTO

Two numbers drive every backup decision:

• Recovery point objective (RPO): how much data you can afford to lose, measured in time. An RPO of one hour means backing up at least hourly.
• Recovery time objective (RTO): how long you can afford to be down before you're running again.

Critical systems usually need a short RPO and RTO. Archives can tolerate much longer ones. Shorter targets generally cost more, so match them to real business impact.

Step 4: Choose your backup methods

Use the 3-2-1 backup rule as your foundation: three copies, on two types of storage, with one offsite. A typical small business setup looks like this:

• Endpoint backup for every computer, ideally centrally managed so you can see which devices are protected.
• Local backup to a NAS or backup appliance for fast restores of large amounts of data.
• Cloud backup for the offsite copy, with immutable storage where available.
• Image backups of servers so you can rebuild them quickly.

Step 5: Don't forget Microsoft 365 and Google Workspace

Cloud apps keep their services running, but under the shared responsibility model, protecting your data is largely your job. Built-in recycle bins and retention features help with recent mistakes, but they're limited in time and scope. A dedicated SaaS backup gives you independent restore points for email, files, and sites, and protects you if an account is deleted or compromised.

Step 6: Secure your backups

Attackers increasingly go after backups first. Protect them with:

• Multi-factor authentication on every backup console and account.
• Separate admin credentials that aren't used for everyday work.
• Encryption in transit and at rest.
• At least one immutable or offline copy.

See how to protect your backups from ransomware for the full list.

Step 7: Document, assign, and test

Write the plan down in plain language. It should answer:

• What is backed up, where, and how often.
• Who is responsible for checking that backups succeed.
• Step-by-step instructions for restoring critical systems.
• Contact details for your IT provider and backup vendor.

Then test it. Restore individual files regularly, and run a full recovery test at least once or twice a year and after major changes. Each test will show you gaps to fix while the stakes are low.

Small business backup checklist

• Every computer, server, and cloud app is listed and covered
• Data is ranked by how critical it is
• RPO and RTO targets are set for critical systems
• Backups follow the 3-2-1 rule, with one offsite copy
• Microsoft 365 or Google Workspace has a dedicated backup
• Backup accounts use MFA and separate credentials
• At least one copy is immutable or offline
• The plan is written down with named owners
• Restores are tested on a schedule

When you're ready to compare business backup services, our 10-point checklist covers what to look for.