How to back up a small business server and prove the restore works

What counts as a backup

A backup is a copy of your data kept apart from the original, so one failure cannot take both[1]. A folder that syncs to another computer or a cloud drive is often not enough. A sync usually copies changes as they happen, and that includes deletions and files that ransomware has locked. A real backup keeps older copies you can go back to.

CISA, the U.S. cyber agency, says backups are your best hope of recovery from a ransomware attack[1]. Ransomware is a program that locks your files until you pay.

Start with a list of what to back up

Write down every place your business data lives. For a typical office that means:

• Shared files and project folders.
• Records that live in software, such as accounting, customer lists and scheduling.
• Email and calendars, if you hold them yourself. If a provider holds them, ask how long it keeps copies and whether you can restore a single message.
• The settings of the server itself, so a replacement can be set up the same way.
• A list of your accounts and who owns each one. Never put passwords on that list.

CISA's guide starts the same way: take inventory of what is on your network, then protect first what the business cannot run without[1]. For each line, mark whether the data sits on your server or another company holds the only copy. The second kind is the one people forget. Our short guide on where your business data lives walks through it.

Keep three copies

Use three copies and treat each one differently:

1. Your live data on the server. This is the copy people work in.

2. A second copy on separate storage in the same place. A network storage box beside the server or a second drive works. It restores fast because it is close.

3. A third copy that is offline or immutable. Offline means unplugged or disconnected. Immutable means it cannot be changed or erased for a set time.

CISA describes the common 3-2-1 rule: three copies, on two types of storage, with one copy off-site[1]. Our rule keeps the same spirit and adds a condition on the third copy. A copy in another building helps with fire and theft. A copy that stays connected and writable can still be reached by the same attack as the original, so we want the third copy out of reach.

Why the offline copy matters

Verizon's 2025 Data Breach Investigations Report found ransomware in 88% of small business breaches, against 39% at larger organizations[2]. That figure describes breaches that already happened. It does not give the odds of being breached. It does say that when a small business is breached, ransomware is usually part of it.

Backups also help with plain accidents: a deleted folder, a failed drive, a laptop left in a taxi. The same three copies cover all of these.

Pick a schedule you can keep

Ask how much work you can afford to redo. If losing a day of changes would hurt, back up every night. If losing a week would be fine, weekly may do. Write the choice down, because the schedule is the promise you are making to yourself.

Keep several older copies, not one. A file damaged on Monday and noticed on Thursday needs a copy from before Monday. CISA advises testing that you can roll data back at least seven days[1].

CISA also advises encrypting backups and giving them physical security[1]. Encryption means the copy is unreadable without a key, so a stolen drive reveals nothing. Keep the key somewhere other than the backup itself.

Run the restore test

The restore test is the step most offices skip, and it is the only step that proves anything. CISA advises scheduled recovery tests to confirm that backups work[1]. Run it like this:

1. Pick a few files and one record. A record is one entry in your accounting or customer software.

2. Delete a copy of them, in a test folder only. Never delete the only copy of anything.

3. Restore them from the backup.

4. Open them and check they are right.

For the first test, restore onto a spare computer, and let the person who uses the files choose the file. A file we pick tends to be one we know is easy. Compare the restored file with the original and write down how long the restore took. A full recovery of everything will take longer than your test, so ask how long the whole job is expected to take and get the answer in writing.

If the test fails, fix the cause and run it again. Do not treat the backup as working until you have seen it pass. The first restore test guide has a printable record for this.

Write two things down

On one page, write where the backups live and the date of the last restore test. If either line is blank, you do not yet know that you can recover. Test again after any change to how backups run, then on a calendar you can keep. We suggest every quarter for a small office.

How the one-week install handles it

In the one-week install, backups are set up on day 3. The restore test runs on day 4 with you watching, and you sign acceptance only after you have seen it pass. The handover record lists where the backup lives. The written quote governs the exact days. Plan my install if you want that done in your office.

Questions

Sources

1. CISA, Back Up Business Data. cisa.gov
2. Verizon, 2025 Data Breach Investigations Report snapshot, as reported in MeshVault's ransomware guide. verizon.com