A missing folder, a ransomware message or a failed laptop can turn an ordinary workday into an expensive interruption. Knowing how to set up backups properly means you can restore what matters without relying on luck, old USB drives or a colleague’s copy of a spreadsheet.
For a home user, that might mean protecting family photos, tax records and a computer that has suddenly stopped starting. For a business, it means keeping customer information, email, accounting files, shared documents and essential systems available when hardware fails or an attack occurs. The right approach is not necessarily complicated, but it must be planned, automated and tested.
Start with what you cannot afford to lose
The most common backup mistake is protecting a device rather than the information on it. A new laptop can be replaced. Years of documents, photos, client records and business history often cannot.
Begin by identifying your critical data. For a sole trader, this may include invoices, contacts, project files, email, cloud storage and accounting data. For a larger team, include shared drives, Microsoft 365 data, line-of-business software, databases, server files, virtual machines and phone system settings where relevant.
Also consider how quickly you need each item back. A few archived documents may be able to wait a day or two. Your accounting platform or job management system may need to be restored within hours. This distinction helps determine the type of backup, storage location and support you need.
It is worth writing down where important data currently lives. Many businesses have files spread across desktop PCs, laptops, shared folders, cloud applications and staff mobiles. If you do not know where the data is stored, you cannot be confident it is being backed up.
How to set up backups using the 3-2-1 rule
A practical starting point is the 3-2-1 rule: keep three copies of important data, on two different types of storage, with one copy stored offsite.
Your first copy is the live version you use every day. The second might be a backup on a network attached storage device, external drive or dedicated backup appliance. The third should be stored away from the premises, usually in secure cloud storage or another physical location.
This matters because a backup kept beside the computer is vulnerable to the same events as the computer. Fire, theft, power damage and ransomware can affect both. A cloud copy gives you geographic separation, while a local copy can make large restores faster when internet speeds are limited.
For many small businesses, a combination works best: local backups for quick recovery and encrypted cloud backups for protection against major incidents. Home users may find that an encrypted cloud backup, paired with an external drive kept safely elsewhere, is sufficient. The right balance depends on the amount of data, your internet connection, budget and how quickly you need to recover.
Choose the right backup method
Not every backup does the same job. File backups copy selected folders and documents. They are useful when you mainly need to recover individual files such as a deleted proposal or damaged spreadsheet.
System image backups create a restorable copy of an entire computer, including the operating system, applications, settings and files. They take more storage but can save considerable time after a hard drive failure, especially for a business PC with specialised software.
Server and application backups need closer attention. A simple copy of a database file may not restore cleanly if the application was open at the time. Systems such as accounting platforms, databases and virtual servers may require application-aware backups that capture data consistently.
Cloud services also need their own backup plan. Files stored in Microsoft 365, Google Workspace or another platform are not automatically protected forever just because they are in the cloud. Syncing is not a backup: if a file is deleted, corrupted or encrypted by ransomware, that change may sync everywhere. Check what retention and recovery options are included, then decide whether an independent backup is required.
Make backups automatic and frequent
Manual backups tend to happen after something goes wrong. Set a schedule that runs without someone needing to remember it.
For active business files, daily backups are usually the minimum. Organisations that update customer data, bookings or financial records throughout the day may need more frequent backups. A backup every hour can significantly reduce lost work after an outage, but it will use more storage and may require a better backup platform.
A sensible retention policy also matters. Keeping only last night’s copy will not help if a problem went unnoticed for several days. Retain multiple versions so you can recover a file from last week, last month or before an attack began. The exact timeframe varies, but many small businesses benefit from daily versions for several weeks, monthly versions for longer-term records and longer retention for compliance-sensitive information.
Avoid scheduling large backups during the busiest part of the day. They can slow devices and internet access, particularly where many staff are uploading data at once. Most backup software can run overnight or throttle its use of network bandwidth.
Protect the backup from cyber attacks
Ransomware operators often look for backups before they do anything else. If attackers can delete or encrypt your backup copies, recovery becomes far harder.
Use separate backup credentials that are not shared with everyday staff accounts. Turn on multi-factor authentication for cloud backup portals, and restrict who can change retention settings or delete backup data. Keep backup software, operating systems and security tools patched, because an unpatched device can become the entry point for an attack.
Where available, use immutable or write-protected backups. These prevent data from being altered or deleted for a defined period, even if an administrator account is compromised. They are particularly valuable for businesses that hold sensitive customer data or cannot tolerate extended downtime.
Encryption is equally important. Your data should be encrypted while travelling to cloud storage and while stored there. Keep encryption keys and recovery credentials in a secure location that more than one trusted person can access if needed. A backup that cannot be decrypted is not a useful backup.
Test restores before you need them
A green tick beside a backup job only confirms that software completed a task. It does not prove that the right files were included or that they can be restored successfully.
Test a small file restore each month. Pick a document, restore it to a separate folder and confirm that it opens correctly. For business systems, test larger recoveries on a planned basis, such as restoring a server image, database or critical application into a safe test environment.
During each test, measure how long recovery takes. This is where expectations often need adjusting. Restoring a few documents from the cloud may take minutes. Restoring several terabytes after a major failure could take days, depending on the internet connection and backup design. If that delay would stop the business, you may need a local recovery option or a managed disaster recovery plan.
Record what was tested, what worked and any gaps discovered. This gives staff a clear process during an incident and helps meet insurance, customer or compliance requirements where applicable.
Assign ownership and keep the plan current
Backups fail quietly when nobody owns them. A business should nominate a person or IT provider to review backup reports, investigate failures and confirm that new systems are included. This is especially important when staff introduce a new cloud app, replace a computer or move files to a different location.
For households, make sure another trusted person knows where recovery details are stored. Keep a short record of which devices are backed up, where the backups are held and how to access them. Do not store the only copy of that record on the computer it is meant to help recover.
Review your setup at least once a year, and whenever your business changes significantly. New staff, additional locations, larger files, new software and customer data requirements can all change what a suitable backup plan looks like.
A good backup setup is quietly boring when everything is working. That is exactly the point. Put the plan in place while there is time to make considered decisions, then test it often enough that recovery feels like a process rather than a crisis.