Small Town Sysadmin
Free CJIS checklist

Tech basics

Backups for a small office: what you need and how to know they work

The simple 3-2-1 rule, why ransomware goes after your backups first, and the one test most offices never do. Plain English, no IT background needed.

Almost every small office thinks it has backups. The hard question, the one you only find out the answer to on a very bad day, is whether you can actually get your files back. Here’s how to make sure the answer is yes.

Start with the 3-2-1 rule

The federal Cybersecurity and Infrastructure Security Agency (CISA) recommends a simple guideline called the 3-2-1 rule:

  • 3 copies of your important data: the original and two backups.
  • 2 different kinds of storage, like an external drive plus an online backup service, so one failure can’t take out both.
  • 1 copy somewhere else, away from the office, so a fire, flood, or break-in doesn’t take everything.

Keep one copy out of reach

Ransomware, the kind of attack that locks your files and demands payment, now routinely looks for backups and destroys them first. A backup drive that’s always plugged into the computer can get locked right along with everything else.

CISA’s guidance is to protect at least one copy by keeping it offline (for example, a drive you unplug and store away after each backup) or on a service designed so the backup can’t be changed or deleted, sometimes called “immutable” backup. Ask your IT person or backup provider which of these you have.

Decide what actually needs backing up

Make a short list of the things that would stop your office cold if they disappeared:

  • Accounting and payroll files
  • Customer, client, or case records
  • Shared documents and templates
  • Email, if it isn’t already protected by your email provider
  • Anything you’d be legally required to produce later

Test it: the step almost everyone skips

A backup you’ve never restored from is a guess. CISA recommends testing that you can actually restore data, both a single file and larger amounts, and that you can go back at least seven days in time. That matters because some attacks sit quietly for days before anyone notices.

A simple test you can do every few months:

  1. Pick a real file you don’t need to change, like last month’s report.
  2. Restore it from your backup to a different folder.
  3. Open it and make sure it’s complete.
  4. Write down the date and the result.

If you have an IT person or company, ask them to do a bigger test at least a couple of times a year: restoring a whole folder, or a whole computer, onto spare equipment. Then ask them to show you it worked.

Questions to ask whoever handles your backups

  • What exactly is being backed up, and how often?
  • Where are the copies kept, and is one of them offline or protected from deletion?
  • How far back can we go?
  • When was the last time we restored something to test it, and did it work?
  • If our main computer died this afternoon, how long would it take to be working again?

If nobody can answer these clearly, that’s your sign to fix it now, not after something goes wrong.

Sources

All articles