The reliable way to back up a small business is the 3-2-1 rule: three copies of anything that would hurt to lose, on two kinds of storage, with one copy off the premises or in a proper backup service. Then restore a file on purpose so you know the copy works. A folder that syncs to the cloud is useful, but a deletion or a ransomware event can follow the sync. An untested backup is a story you tell yourself until the afternoon it fails.
This is about recoverable copies, not about antivirus. If you are asking whether Defender is enough, that is do I need antivirus in 2026.
Why do ordinary businesses lose data?
The list is mundane. That is why people skip it.
A laptop is dropped or stolen. A drive dies. Someone deletes a year of invoices and the sync copies that deletion everywhere. Ransomware encrypts a folder. A leaver takes the only photo archive. A fire takes the office and the USB in the same drawer.
The pain is quotes, job photos, customers and accounts. You can rebuild a website. You cannot rebuild three years of photos from memory. The dangerous belief is that “it is in OneDrive” or “it is on the USB in the van” without ever opening a file from that copy.
What is the 3-2-1 rule in practice?
Three sentences.
Three copies. The live files you work on, plus two backups. One copy is one failure away from nothing. The live laptop does not count as a backup of itself.
Two types of storage. An external disk and a backup service, for example. Two USB sticks in the same bag are one type of failure waiting to happen. Two folders in the same Microsoft tenant can also be one type of failure if the account is gone.
One off-site. A disk that lives in the office next to the PC is not off-site. A fire, a theft or a burst pipe takes both. Off-site usually means a backup product that is not the same as your everyday sync, or a disk that lives somewhere else and is updated on a rhythm you actually keep.
Follow those three and you have covered the common ways copies vanish. You need a boring system that runs without a reminder, and a calendar note to test it.
What should you actually back up?
Not “everything on the C drive”. That is how you pay to copy rubbish and miss the folder that matters.
Back up what would cost time, money or sleep to recreate:
- Customer records, contacts and job history.
- Accounts, invoices, VAT workings and the export from whatever you use to bill.
- Quotes, contracts and the correspondence that proves what was agreed.
- Photos and videos of work, especially for trades. Those are a sales asset, not a souvenir.
- Email, if the inbox is the only archive of decisions.
- Anything you would have to tell a customer you lost.
Leave behind installer files and duplicate photo dumps you will never search. Think in places: where quotes live, where photos land, where the bookkeeper keeps last year. If a place is not on the list, it will not be on the backup.
Phones matter. Finished jobs often live on a personal camera roll. Auto-upload to an account the company controls beats hoping the handset survives.
Is cloud storage the same as a backup?
No. This is the distinction that catches people who already pay for Microsoft 365 or Google Workspace.
Sync (OneDrive, Google Drive, Dropbox in everyday use) keeps folders aligned across devices. That is excellent for access. It is a poor backup when:
- Someone deletes a folder and the deletion replicates.
- Ransomware encrypts files and the encrypted versions upload.
- A person signs in on a new PC and overwrites a shared folder with an old copy.
- The only “off-site” copy is the same tenant you just locked yourself out of.
Those products do have recycle bins and version history. Learn what yours actually keeps, and for how long. That history is useful for last Tuesday’s mistake. It is not the same as a second system that keeps recoverable points you choose.
A proper backup copies on a schedule, keeps versions for a period you set, and lets you restore to a date before the mess. Some backup tools sit on top of the same cloud. The point is the separate job: recover, not sync.
If everything important already lives in a tenant, your backup plan still has to name what is not in the tenant. The “scan” folder on the desktop. The accounts file on a USB. The mailbox you never migrated. Those are the files that vanish while you feel “in the cloud”.
How do you test a restore without a drama?
Pick a file you know, from last month. Restore it to a different folder. Open it. Check it is the right version, not a zero-byte stub and not a file from 2019.
Do that twice a year. Put it in the same calendar you use for VAT. Ten minutes.
While you are there, confirm the backup still ran. Silent failures are normal: a laptop asleep at the only backup window, a disk that filled up, a password change that broke the job, a person who unplugged the drive “just for the day” in March.
Test a folder, not only a single Word doc, if your work is photo-heavy. A restore that works for a 20KB invoice and fails on 8GB of images is a restore that fails the week you need it.
If you cannot restore because nobody knows the login, that is the finding. Write the login process down somewhere that is not only inside the machine you are backing up.
How do you set this up once and leave it running?
Choose tools that do not rely on memory.
A typical small-firm pattern:
- Put working files in the company tenant so daily access is not a USB shuffle.
- Turn on a backup that keeps versions of those files, plus anything that still lives only on a PC.
- Keep a local disk for a fast restore of everyday mistakes, and do not leave that disk plugged in all week if you want it to survive ransomware.
- Keep the off-site copy automatic.
- Write a half-page: what is covered, what is not, who can restore, when you last tested.
Page Forge can design that once, as a project, and hand over the notes. We are not a managed backup provider and we do not run a helpdesk. See IT and AI consulting. Backups are one layer. They will not stop someone sending mail as you. They will let you recover files after a bad day.
Frequently asked questions
Is OneDrive or Google Drive enough on its own?
Not as your only copy. Sync is convenient and version history helps with recent mistakes. A deletion, a bad overwrite or ransomware can still follow the sync. Keep a backup that can rewind to before the problem, and know what never left the laptop.
How often should I back up business data?
Automatically, and at least daily for anything that changes. The point of a modern job is that you do not remember to click it. Frequency matters less than the job actually running and a restore you have tried.
What is the 3-2-1 backup rule?
Three copies, two kinds of storage, one copy off-site. It is a simple way to avoid a single broken disk, a single stolen bag, or a single building incident taking everything. It is still the right standard at this size.
Do I need to back up email?
If the inbox is your archive of quotes, instructions and complaints, yes. Many suites keep mail in the tenant. Confirm retention, and confirm that a deleted mailbox is not gone in a day. If mail still lives only in a program on one PC, that is a live risk.
What about photos on phones?
If they win work, they are business data. Auto-upload to an account the company controls, then include that account in the backup thinking. A personal camera roll with no second copy is a single point of failure in a pocket.
Will Page Forge monitor my backups every month?
No. We can set a sensible arrangement up as a project and show you how to test it. Ongoing watching is not our product. We do not sell a support contract for backup alerts.
If you want a backup you can restore from, rather than a disk you hope is fine, that is a bounded piece of work. See IT and AI consulting, or get in touch. Bring a list of where quotes, photos and accounts live. That list is the job.