“How often should we back up?” sounds like it should have a single answer. It does not, but there is a simple way to work it out for your business.
Start with how much data you can afford to lose
Ask: if we lost everything since the last backup, how much work would we have to redo? If the answer is “a day’s worth would be painful but survivable”, you need at least daily backups. If losing an hour of orders or accounts would be serious, you need backups more often than that, or continuous protection. This is your Recovery Point Objective (RPO), explained in our disaster recovery plan template.
A sensible starting point for most small businesses
- Servers and shared files: at least daily, with more frequent snapshots during the working day for busy systems.
- Microsoft 365 email and files: daily or more, with a separate backup service rather than relying on recycle bins (see does Microsoft back up your 365 data?).
- Accounts and line-of-business databases: as often as the software supports, often several times a day.
- Laptops: keep work files in OneDrive or SharePoint so they are covered centrally.
The 3-2-1 rule
Keep at least three copies of your data, on two different types of storage, with one copy offsite. Many businesses now add a further rule: at least one copy should be offline or immutable (cannot be changed or deleted for a set period). Ransomware actively looks for and destroys backups it can reach.
What good backup practice looks like
Make regular backups of your most important data, keeping at least one offline copy separate from your network (ideally offsite), not leaving backup drives permanently connected, and using cloud services that protect previous versions from being overwritten.
Retention: how far back can you go?
Frequency is only half the picture. If ransomware or corruption goes unnoticed for weeks, daily backups that only keep 14 days will all contain the problem. Keep a mix: for example daily copies for a month, weekly copies for a few months, and monthly copies for a year or longer.
Test your restores
A backup you have never restored from is a hope, not a plan. Test restoring individual files regularly, and test restoring a whole system at least once a year. Time it, so you know whether you can meet your recovery time. See why untested backups are not a ransomware plan.
Protect the backups themselves
- Use separate credentials for the backup system, protected with multi-factor authentication.
- Do not let everyday admin accounts delete backups.
- Get alerts when a backup fails, and make sure someone reads them.
When to speak to BMT
Our managed backup service sets the schedule around your business, keeps offline or immutable copies, and tests restores so you know they work. For bigger incidents, see disaster recovery. Call us on 0161 672 7461 or 01706 391 047, or get in touch online.
Related reading
Don’t pay the ransom: plan your recovery · OneDrive backup: protecting business data · Managed backup