Small Business Data Backup Plan: 3-2-1 Guide in 7 Steps
A small business data backup plan is what lets you get your information back when something breaks: a dead drive, an employee who deletes the wrong folder, a stolen laptop or a ransomware attack. The short answer: follow the 3-2-1 rule (three copies, on two different types of media, one offsite), automate it, keep at least one copy nobody can change, and test a restore every month. A backup you have never restored is not a plan. It is an assumption.
This guide covers what to back up, how often, where to keep it and how to prove it works. It is written for owners and managers who are not technical but who end up paying the bill on the day the data is gone.
What is the 3-2-1 backup rule?
It is the most widely used starting point for backup design. As NinjaOne's explainer puts it, you keep at least three copies of your data, two of them on different types of media, and at least one offsite or in the cloud.
- 3 copies: the live data your team works with, plus two backups.
- 2 media types: for example, a NAS (network storage box) in the office and a cloud backup service, so one failure does not take everything.
- 1 offsite: a fire, flood or break-in hits the server and the USB drive sitting next to it equally.
The rule has been around for a while. According to ManageEngine (page in Spanish), it became a recognized best practice in the early 2000s. That is why you now see extended versions: 3-2-1-1 adds one immutable copy that cannot be altered or deleted, and 3-2-1-1-0, as NinjaOne describes it, adds zero backup errors on verification.
Why 3-2-1 alone is no longer enough
Modern ransomware does not stop at your file server. It looks for backups reachable on the same network and encrypts or deletes them too. If your only local backup is a drive permanently mapped to the server, it is part of the blast radius.
The second trap is treating sync as backup. If your cloud folder syncs with a laptop and malware encrypts the files, the cloud dutifully stores the encrypted versions. What saves you is version history and an independent copy: the ability to roll back to how things looked three days ago. For current threat guidance, the US government's CISA StopRansomware hub is a good reference to share with whoever runs your IT.
What data should a small business back up?
You do not need to back up every disk image. You need to back up what you cannot rebuild. Software can be reinstalled; your data cannot. Use this table to start your inventory:
| Data | Where it usually lives | What to check |
|---|---|---|
| Accounting, invoices, payroll | QuickBooks, Xero or similar, shared drives | A full, scheduled export you control, not just on-screen reports |
| Customers, sales and orders | CRM, point of sale, online store | You can download the complete dataset, not only summaries |
| Contracts and HR files | Google Drive, SharePoint, file server | Version history on, delete permissions restricted |
| Google Workspace, Microsoft 365 | What your plan retains, for how long, and whether you need a third-party backup | |
| Databases behind your own software | Your server or cloud account | Automated backups, a copy in a separate account, tested restores |
| Website and e-commerce | Hosting provider, store platform | Files, database and DNS settings documented |
| Configurations and admin access | Scattered across people and tools | An inventory of systems, admin accounts and who holds each one |
Be careful with SaaS. Having your CRM or store in the cloud does not mean you have a backup you control. Read each vendor's terms to see what they protect (their infrastructure) and what is on you (your data, and anything a user deletes by mistake). If the system is yours, such as custom software built for your operation, the backup plan belongs in the contract and the handover documentation.
How to create a data backup plan in 7 steps
- Inventory your systems. List every place important data lives, who owns it and what happens if it vanished tomorrow. This step usually turns up critical files that exist only on one person's laptop.
- Set recovery targets. For each system, decide how much work you can afford to lose (RPO) and how long you can run without it (RTO). More on both below.
- Apply 3-2-1-1. Live data, a local copy for fast restores, an offsite copy and, ideally, one immutable or offline copy.
- Automate everything. Manual backups get skipped sooner or later. Schedule them and take human memory out of the loop.
- Separate credentials. The account that manages backups should not be anyone's everyday login, and it should require multi-factor authentication. If an attacker gets a staff account, they should not be able to wipe the backups.
- Monitor and alert. A named person should get notified when a job fails. Otherwise you find out on the worst possible day.
- Test restores. Restore a random file every month and a full system at least once a year. Time it. That number is your real RTO, not the one in the policy.
How often should you back up? RPO and RTO in plain terms
The 3-2-1 rule does not set a frequency, and that is where many plans go wrong. Frequency comes from the recovery point objective of each system: if your order database is backed up once a night and fails at 11:59 p.m., you can lose almost a full day of transactions.
- RPO (recovery point objective): how much data you can lose, measured in time. A marketing folder might tolerate a day; online orders might tolerate minutes.
- RTO (recovery time objective): how long operations can be down while you restore. Pulling from a local NAS is usually faster than downloading everything from the cloud.
The useful question for an owner is not technical: "If we lose this at 6 p.m., how much work do we redo, and what does that cost us?" Your IT team or provider can pick tools and schedules from that answer.
Cloud backup vs. NAS vs. external drive
It is not either/or. Each medium covers a different risk, which is the whole point of 3-2-1.
| Medium | Pros | Cons | Best role |
|---|---|---|---|
| External drive | Simple, can be fully disconnected | Relies on someone plugging it in; gets lost or damaged | Offline copy for very small teams, rotating drives |
| Office NAS | Fast, automated local restores | Shares physical and network risk with the office | Quick recovery of files and machines |
| Cloud backup | Offsite, versioned, no hardware to maintain | Large restores take time; depends on bandwidth | Offsite copy, ideally with object lock or immutability |
Common backup mistakes small businesses make
- Treating sync as backup. Without versions, mistakes and ransomware replicate as faithfully as good files.
- Leaving the backup always connected. If an attacker can reach the server, they can reach the backup.
- Never testing a restore. Teams often learn a backup was incomplete at the exact moment they need it.
- Forgetting the website and SaaS apps. Your website, store and CRM hold business data too.
- Single-person dependency. If only one person knows where backups live and how to restore them, the risk is still there. Write the procedure down.
Small business backup checklist
- We have an inventory of critical systems and data, each with an owner.
- Every system has an agreed RPO and RTO.
- There are three copies, on two media types, with one offsite.
- At least one copy is immutable or offline.
- Backups run automatically and failures trigger an alert to a named person.
- Backup admin credentials are separate and protected with MFA.
- This month we restored a test file and recorded how long it took.
If this checklist shows your data is spread across spreadsheets, laptops and disconnected tools, the issue is bigger than backups: it is architecture. At Disruptive we build systems with backups, access control and documentation from day one. If you want a second opinion on your setup, get in touch.
Frequently asked questions
What is the 3-2-1 backup rule?
Keep three copies of your data, on two different types of media, with one copy stored offsite. The goal is that no single incident can destroy the data and all of its copies at once.
How often should a small business back up its data?
It depends on how much data each area can lose without hurting operations, its RPO. Systems that change constantly, like orders and billing, need more frequent backups than documents that rarely change.
Is Google Drive or OneDrive a backup?
Not by itself. Sync tools replicate deletions and encrypted files; you need version history, an independent copy and a clear view of what your plan actually retains.
What is an immutable backup?
A copy that cannot be changed or deleted for a set period, even by a compromised admin account. It is the most direct defense against ransomware that tries to wipe backups before encrypting your files.
