Business backup checklist: what to back up and how to know it works

What actually needs backing up

The test is not "is this important" but "could we rebuild this". Software can be reinstalled. Six years of invoices cannot.

1. 1Business documents and shared drives.
2. 2Email, including anything that lives only in one person’s mailbox.
3. 3Accounting and payroll data, which is often on one machine under one desk.
4. 4Customer records, quotes and contracts.
5. 5Website and any databases behind it.
6. 6Configuration you would otherwise have to rediscover, such as how the network is set up.

Cloud storage is not a backup

This is the most common and most expensive misunderstanding. OneDrive, SharePoint, Google Drive and Dropbox are sync services. They copy what happens, and that includes deletion and encryption. If ransomware encrypts a synced folder, the encrypted version syncs to the cloud within seconds.

Sync protects you from a dead laptop. It does not protect you from something that damages the files themselves.

1. 1Keep a separate backup that is not a live sync of your working files.
2. 2Make sure at least one copy cannot be reached from the machines it protects.
3. 3Understand your provider’s retention window: recovery there is usually days, not months.

How often, and how far back

Two questions decide everything. How much work can you afford to redo, and how long can you be stopped? Answer those honestly and the schedule follows.

1. 1If losing a day of work is unacceptable, you need at least daily backups.
2. 2Keep several historical points, not just the latest. Corruption often goes unnoticed for a week, and by then the only copy is the corrupted one.
3. 3Keep at least one copy off-site or in another provider, because fire and theft take everything in the building.
4. 4Write down how long a full restore would actually take. That number is usually longer than anyone expects.

The test that makes it real

Backups fail quietly. The job reports success while backing up an empty folder, or it stopped three months ago and the alert went to somebody who left. None of that shows up until you need it.

1. 1Restore a real file from last week and open it. Not a test file you created for the purpose.
2. 2Restore something from a month ago, to confirm older points are genuinely there.
3. 3Check the backup actually contains what you think, rather than a folder that moved.
4. 4Put the test in the calendar quarterly, and give it to a named person.