How should a small business back up its data? The 3-2-1 rule, whether Microsoft 365 backs itself up, cloud vs local, and why you must test restores.
A small business should follow the 3-2-1 rule: keep three copies of your important data, on two different types of storage, with one copy kept off-site or in the cloud. Back up automatically every day and, most importantly, test that you can actually restore, because a backup you have never tested is just a guess.
Backups are the safety net under everything else in security. Ransomware, a failed hard drive, a deleted folder, or a lost laptop all have the same answer if your backups are solid: restore and carry on. Here is how to set them up without overcomplicating it.
What is the 3-2-1 backup rule?
The 3-2-1 rule means three copies of your data, on two types of media, with one copy off-site. The original on your computer counts as one copy, so you need two more, and at least one must live somewhere separate so a fire, theft or ransomware attack can't take everything at once.
Warning: A backup drive left plugged into the same computer can be encrypted by ransomware along with the original, which is why the off-site copy matters so much.
What data do you actually need to back up?
Back up anything you could not easily recreate: financial records, client files, emails, and any systems your business runs on. A quick way to decide is to ask what would hurt if it vanished tomorrow. If losing it would stop you invoicing or serving clients, it needs a backup.
- Accounting and financial records
- Client and matter files
- Email and shared mailboxes
- Anything stored only on one person's laptop
Does Microsoft 365 back itself up?
Not in the way most people assume. Microsoft keeps your service running and protects against their own outages, but they operate a shared-responsibility model: your data is your responsibility. If a staff member deletes files or an account is compromised, items can be lost for good once the short retention window passes. Many businesses add a dedicated Microsoft 365 backup for this reason.
Note: Microsoft runs a shared-responsibility model, so keeping the service online is their job while keeping a recoverable copy of your data is yours.
Cloud backup or local backup?
For most small businesses, cloud backup is the simpler and safer default because it is automatic and off-site by design. A local backup, like an external drive or a network device, can be faster to restore large amounts, so a mix is ideal.
| Cloud backup | Local backup | |
|---|---|---|
| Off-site by default | Yes | No, unless you rotate drives |
| Automatic | Usually | Sometimes |
| Restore speed (large data) | Slower | Faster |
| Best role | Primary off-site copy | Fast local copy |
Well-configured cloud storage makes the off-site copy effortless, and backups sit right alongside the other cyber security essentials every small business needs.
How often should you test a restore?
Test a restore at least every few months, and after any big change to your systems. The test is simple: pick a file or a mailbox and actually recover it. If it comes back cleanly, your backup is real. The Australian Cyber Security Centre lists regular, tested backups among its top recommendations for exactly this reason.
Best practice: Put a recurring reminder in the calendar to actually restore one file or mailbox every few months, so you discover any gaps on a quiet day rather than during a real emergency.
The short version: follow 3-2-1, automate it, add a dedicated backup for Microsoft 365, and test your restores so you know the safety net holds.
Frequently asked questions
What is the 3-2-1 backup rule?
Three copies of your data, on two different types of storage, with one copy off-site or in the cloud. It protects you from single points of failure like a dead drive or a ransomware attack.
Does Microsoft 365 back up my data automatically?
Not fully. Microsoft keeps the service running, but your content is your responsibility, and deleted or compromised data can be lost after a short retention period. A dedicated 365 backup closes that gap.
How often should I back up?
Daily is the sensible default for a business, done automatically so no one has to remember. Critical systems may warrant more frequent backups.
How long should I keep backups?
Keep at least several months of history, and longer for financial and legal records to meet your obligations. Longer retention also helps if a problem is only noticed weeks later.
Is cloud backup safe?
Yes, reputable cloud backup is encrypted and stored off-site, which makes it safer than a single drive on your desk. Just make sure the account protecting it has MFA turned on.
Not sure your backups would survive a bad day? Take the free business health check and we will help you find the gaps.