Simple Backup and Recovery Plans Every Small Business Needs
If your server died tonight, or ransomware locked every file in the office, how long would it take to be back in business? For many small businesses the honest answer is “we don’t know”. A simple, tested backup plan turns that into a number you can live with.
Start with two questions
- How much work can you afford to lose? An hour, a day or a week? This decides how often you back up.
- How long can you afford to be down? This decides how your backups are stored and how quickly you can restore them.
A busy accounting practice might accept losing an hour of work and being down for half a day. A sole trader might accept a day of each. There is no right answer, but you should choose one on purpose.
Use the 3-2-1 rule
- 3 copies of your important data: the original plus two backups.
- 2 different types of storage, for example a local backup device and the cloud.
- 1 copy offsite and protected from changes, so a fire, theft or ransomware attack in the office can’t reach it.
Many backup services now offer “immutable” storage, meaning backups can’t be changed or deleted for a set period. This is one of the best defences against ransomware, which often tries to delete backups first.
Back up everything that matters, not just the server
- File shares and servers
- Microsoft 365 or Google Workspace: email, OneDrive, SharePoint and Teams. Microsoft and Google keep their services running, but protecting your data from deletion, mistakes or attacks is your job.
- Line-of-business software and its databases
- Laptops that hold work not saved anywhere else
- Configurations for firewalls, phones and websites
Write a one-page recovery plan
When something goes wrong, nobody wants to read a 40-page document. Keep it to one page:
- Who to call first, inside the business and at your IT provider
- Which systems to restore first, in order of importance
- Where the backups are and how to access them
- How staff keep working in the meantime
- Who talks to clients, insurers and, if personal data is involved, regulators
Store a copy somewhere you can reach even if your systems are down.
Test your restores
A backup you have never restored is only a hope. Test regularly:
- Monthly: restore a few files and an email folder.
- Every six to twelve months: restore a whole server or system, and time how long it takes.
- After any big change, such as a new server or software: check the new system is being backed up.
Regular, tested backups are part of the ASD Essential Eight, and many cyber insurers now ask about them.
How long to keep backups
Keep enough history to recover from problems you do not notice straight away. Ransomware and accidental deletions are often discovered days or weeks later, so a backup that only keeps the last seven days may already contain the damage.
- Daily backups kept for at least 30 days
- Monthly backups kept for at least 12 months
- Longer retention for records you are legally required to keep, such as financial records (generally five years for tax purposes) or health records
Check your own obligations with your accountant or professional body, and make sure your backup retention matches them.
Why backups matter more in 2026
Ransomware remains one of the biggest threats to Australian small businesses, and attackers now go after backups first. Since 2025, businesses with annual turnover over $3 million must also report any ransomware payment to the Australian Signals Directorate within 72 hours under the Cyber Security Act 2024. Reliable, offsite, tamper-proof backups are what let you recover without ever facing that decision.
Signs your backups need attention
- Nobody gets an alert when a backup fails
- Backups are stored on a drive plugged into the server they protect
- Microsoft 365 or Google Workspace data is not backed up separately
- The last restore test was “a while ago”
Cloud storage alone is not a backup. Read why in our guide to choosing cloud storage for your business, or see how our managed cloud and backup services handle it for you. To check your backups against the wider security baseline, use our free Essential Eight checklist.
Would your backups actually work?
We check what is backed up, where it is stored and how quickly you could recover, as part of a free IT Health Check.
Or call 1300 133 770.
