A server will not start, someone deletes a shared folder, or a laptop disappears with work saved on it. Your immediate concern is getting the business running again. Having a backup helps, but only if it contains what you need and can be recovered in a useful amount of time.
For a small business without internal IT staff, the goal is straightforward: know what is protected, keep copies that can survive the same incident, and verify how recovery works. These are the points to understand before reviewing your setup with an IT provider.
Start with what your team needs to work
List the systems that support everyday operations: accounting software, customer records, shared documents, business applications and files stored on individual PCs. A backup of the server does not automatically include a spreadsheet saved only on an employee’s desktop.
For each system, identify where its information lives and what would be needed to use it again. Documents are one part of the picture. Application settings, databases and other supporting components may also matter. Some applications need a specific backup method to ensure their data can be recovered in a usable state.
Revisit this list when you add computers, change software or move folders. Coverage can fall behind as the business changes. Microsoft 365 data also needs its own backup, as we explain in our article on Microsoft 365 backup. Backing up PCs and servers does not automatically protect everything your team keeps in cloud services.
Use the 3-2-1 rule as a starting point
The 3-2-1 rule helps prevent one failure from taking away every usable copy of your data:
- 3 copies of your data: the working original and two backup copies;
- 2 different media or storage types: for example, local backup storage and cloud backup storage;
- 1 copy offsite: outside your premises, where a theft, fire or water leak at the office cannot reach it.
Two folders on the same drive do not count as two storage types. A backup drive beside the server is not offsite. The practical question is whether the copies could all be lost in the same event.
The extended 3-2-1-1-0 rule adds one offline, air-gapped or immutable copy, plus a target of zero errors in verified restores. An air-gapped copy has a separation that prevents access from the normal network. The zero means checking recovery results and resolving errors. A successful backup notification alone does not establish that everything will restore correctly.
Keep ransomware away from backup copies
Ransomware blocks access to data, commonly by encrypting it, and demands payment. Attackers often target backups before disabling the systems people use. If backup storage is available through the same accounts and network access as everyday files, those copies can be at risk too.
Isolate backup storage and administration from normal network access and everyday accounts. Restrict who can manage backups and use separate administrative credentials. Multi-factor authentication requires an additional check beyond a password when someone signs in. The tools used to manage backups need protection as well.
An immutable copy cannot be changed or deleted for a set period, even with administrator credentials. Ask whether that protection is actually enabled and how long the lock lasts. A product offering immutability does not mean your backup copies have been configured to use it.
Offsite, offline and immutable describe different protections. A cloud copy is offsite, but it may still be deletable through a compromised account. An offline copy is disconnected. Your provider should be able to explain how the chosen safeguards work together and which copies would survive an attack on your normal systems.
Keep recovery history and choose the right backup
The newest backup is not always the one you need. A damaged file may go unnoticed until after it has been backed up again. Versioning means keeping several points in time so you can recover a version from before corruption, unwanted changes or encryption occurred.
Backup frequency and retention answer separate questions. Frequency determines how much recent work might be missing. Retention determines how far back you can look. Keeping frequent copies for a very short period may not help with a problem discovered much later.
A file-level backup lets you recover selected files and folders. An image backup captures the machine more broadly, including its operating system, applications, settings and covered data. It can support a bare-metal restore: rebuilding a PC or server on an empty machine from the backup.
File recovery may be enough for a PC that is straightforward to set up again. An image can matter more for a server with a complicated configuration. Replacement hardware, software licences and application requirements still need to be considered; an image does not remove those dependencies.
Decide how much downtime and lost work you can accept
Your recovery time objective, or RTO, is how long the business can afford to be without a system. Consider what happens when it stops. Could staff keep taking orders using a temporary process? How long could that arrangement work before it caused serious disruption?
Your recovery point objective, or RPO, is how much recent work you can afford to lose. If recovery brought you back to the previous evening, could your team re-enter the transactions since then? Would some information be impossible to reconstruct?
Different systems can have different objectives. These decisions guide backup frequency and recovery arrangements. Restoring service also involves more than copying files: someone must identify a clean recovery point, obtain any needed equipment, restart applications and confirm that staff can use them. The recovery plan should account for that whole process.
Treat file sync and backup as separate functions
Tools such as OneDrive sync keep files updated across locations. That makes everyday work easier, but synchronization can also carry an accidental deletion, an unwanted edit or an encrypted file to another location.
Recycle bins and version history can help recover some items, depending on their settings and limits. They do not replace an independent backup with defined retention and a tested recovery process. Seeing the same document on two computers does not establish that you have two independently protected copies.
Test recovery and ask for clear answers
A backup that has never been restored is a hope, not a plan. Regular tests should include recovering files and, for essential systems, starting the restored machine in an isolated environment. Check that documents open and applications work. Record how long the process took and what needs fixing.
At Evolute I.T., we monitor backups and run restore tests. Monitoring helps identify failed backup jobs; restoration tests check whether the saved copies are usable. Ask your IT provider these questions:
- Which PCs, servers, applications and folders are backed up?
- How often are backup copies created?
- Where are the copies stored, and how are they isolated?
- Are they immutable, and for how long?
- How long are older versions kept?
- When was the last restore test, and what did it confirm?
- How long would a complete server restore take?
- Who receives failure alerts and follows up?
A useful backup plan connects your stored copies to the way your business operates. You should know what can be recovered, how recent it will be and what it takes to get your team working again.
To review protection for your PCs and servers, explore our managed IT services or contact our team.
