Backup readiness: could your business survive losing its files?

Here’s a question worth answering honestly, while it’s still hypothetical: if your business lost its files tonight — all of them — how would tomorrow go?

Not “do you have backups?” Almost everybody answers yes to that. The real question is whether those backups would bring you back: how much you’d lose, how long you’d be down, and whether anyone has ever actually proved it by restoring something.

Most 20-person companies in the Coastal Bend can’t answer that. Their backup is a drive someone plugs in when they remember, or a service somebody set up two years ago that reports “successful” every night to no one in particular. That is not a plan. It’s optimism with a power cord.

Backup readiness comes down to five checks. None of them takes technical knowledge to ask about. All of them have answers you can verify.

1. What would actually take your files out?

Start here, because “losing your files” is not one disaster — it’s several, and a backup that survives one may not survive another.

• Ransomware. The attacker encrypts everything they can reach on your network. If your backup is connected to that same network, it gets encrypted too.
• A failed drive or a dead server. No villain required. Hardware wears out, usually on a Friday afternoon.
• Water and storm damage. This is the Coastal Bend. A roof leak, a flood, or a storm-damaged office can take the server and the backup drive sitting next to it in the same hour.
• A plain mistake. Someone deletes the wrong folder, overwrites the good copy of a spreadsheet, or cleans out a shared drive they thought was a duplicate. This one happens constantly, and nobody notices for weeks — sometimes past the point where the backup still holds the file.
• A laptop that walks away. If the only copy of your bids, your client records, or your accounting lives on one person’s laptop, that laptop is your backup plan.

A ready business has an answer for every item on that list — not just the dramatic ones.

2. Follow the 3-2-1 rule

This is the shape of a backup that survives, in plain English:

3 copies of everything that matters. 2 different kinds of storage. 1 copy offsite, away from your building.

In practice that usually looks like: the files your team works on, a copy on a separate backup system in the office, and a copy in the cloud. Ransomware, a fire, or a flood can take one or two of those. It rarely takes all three.

If your three “copies” are three folders on the same server, you don’t have three copies. You have one copy with extra steps.

3. A copy the attackers can’t reach

This is the check most small companies fail without knowing it.

If your backup sits on your network, reachable with the same passwords everything else uses, then whoever breaks in can reach it too — and attackers go looking for backups on purpose, because a business that can’t restore has to consider paying.

Your offsite copy needs to be separate in fact, not just in geography: not browsable from your everyday network, not openable with the password taped to a monitor, and not deletable by the same account that runs your day-to-day work.

Ask the question directly: “If ransomware got in tonight, could it touch our backups?” If nobody can answer yes or no with confidence, that’s your answer.

4. Automatic — not dependent on somebody remembering

The most common backup in a small business is a person. Somebody plugs in the external drive on Fridays. Somebody copies the accounting folder before tax season. Somebody meant to set it up after the last scare.

People get busy, go on vacation, and leave the company. A backup that depends on a human remembering a chore will have gaps, and the gaps never announce themselves.

Ready means: backups run on a schedule, with no human step in the middle — and somebody can see, at a glance, that last night’s run actually completed. “Successful” messages nobody reads don’t count as checking.

5. Tested — someone has restored from it, and can name the date

This is the whole ballgame, and it’s the part almost everyone skips.

A backup you have never restored from is a hope, not a backup. Backups fail quietly: the wrong folder was being copied, the job filled up and stopped months ago, the files restore corrupted, the password to unlock them left with a former employee. You find out about all of that in exactly one of two ways — during a calm test, or during the worst week of your year.

The test is simple. Pick a real file — last month’s payroll spreadsheet, a client folder, anything that matters — and bring it back from the backup. Time it. Do it at least once a quarter, and put the next test on the calendar before you close this tab.

Ask your office one question this week: “When did we last restore something from backup — not check the dashboard, actually restore it?” If nobody can name a date, schedule the test. That date is the difference between “we have backups” and “we’re ready.”

Two more questions: how much can you lose, and how long can you wait?

Once the five checks pass, readiness has two numbers attached to it, and every owner should know theirs — even roughly.

How much work can you afford to lose? If your last good backup is from Friday and the failure hits Thursday, you lose most of a week’s work: invoices, emails, schedule changes, everything typed since. For most small offices, a nightly backup is the floor. If a day’s work is expensive to redo, you need copies taken more often than that.

How long can you be down? Restoring everything takes time, and “we have the files somewhere” is not the same as “we’re working again.” A full server rebuild can take days if nobody planned the order of operations. Know the honest estimate for your business — an afternoon, a day, three days — and decide now whether your customers and your payroll can live with it. Finding out during the outage is too late to change it.

Neither number needs to be perfect. Both need to be known.

What actually needs to be in the backup

One last trap: a backup can be working perfectly and still be copying the wrong things.

Walk through where your business actually lives. For most Coastal Bend firms that’s some mix of: the shared drive or server, your accounting, your line-of-business software (the dispatch system, the practice software, the estimating tool), and Microsoft 365 — email, OneDrive, and SharePoint.

That last one surprises people. Microsoft keeps the service running; that is not the same as keeping your data forever. A deleted mailbox or a wiped SharePoint folder can age out of recovery before anyone notices it was gone. If your email and cloud files matter — and they do — they belong in a backup you control, with retention you chose on purpose.

If it would hurt to lose it, it should be in the backup. If it’s in the backup, it should have passed a restore test. That’s the whole system.

The bottom line

Backup readiness isn’t a product you buy once. It’s five checks — a backup that covers the real ways files get lost, three copies with one offsite, a copy attackers can’t reach, a schedule no one has to remember, and a restore somebody has actually tested and can date.

Most of that costs less than one day of being closed. All of it costs less than explaining to your customers that their records are gone.

If you don’t know where your business stands on these five, that’s what the $495 Network & Risk Assessment is for. We check your backups first — including when a restore was last tested — and give you a written report, in plain English, on what’s solid and what’s risky. If you’re in good shape, we’ll tell you that too.

Related: What managed IT actually costs for a 20-person company

Related: 5 security basics every 20-person company needs (and what most skip)

Frequently asked questions