Contents
Short answer
A backup is only reliable once restoring has been tested. For small businesses that means automatic backups including cloud data, at least one copy offline or immutable, and a practised restore. Even then there is no absolute security – but the chance of continuing after an incident rises considerably.
Why does this matter for small businesses?
Ransomware encrypts not only working data but specifically looks for reachable backups. Without a separate copy and a practised restore, small businesses often stand still for days. Cloud services also do not automatically protect your data against deletion or encryption by a compromised account.
- Production system
- Backup
- Separate copy
- Restore test
What does it include?
Regular backups
Automatic, with several versions across days or weeks.
Basic
Offline or immutable copy
At least one copy that an attacker with your credentials cannot delete or encrypt – stored separately or with deletion protection.
Basic
Restore tests
Regularly check that files and whole systems can actually be restored in acceptable time.
Basic
Cloud backup
Back up mailboxes, file shares, shop and accounting data separately if the provider's retention is not enough.
Useful as IT grows
Disaster recovery
Define the order in which systems are restored and how long an outage may last.
Relevant with higher risk
What does it protect against?
- Data loss from ransomware, failure, theft or user error
- Long downtime, if restore has been practised
What does it not protect against?
- Theft and publication of stolen data
- Backups reachable and deletable with the same credentials
- Restoring infected states when the cause has not been removed
Which basic measures are often enough?
- 01Automatic backup of all key devices and cloud data
- 02One copy offline or immutable
- 03Backup accounts with MFA and separate credentials
- 04Test a restore at least once a year and note the duration
When does a more advanced solution make sense?
With high IT dependency, an online shop or contractual delivery obligations, a documented recovery plan with target times, regular full tests and possibly a fallback environment becomes worthwhile. An IT provider can help.
Common mistakes
- Mistaking sync for backup
- Managing backups with the same admin credentials as production systems
- Never testing a restore
- Restoring immediately after an incident without knowing the cause
Checklist
- All key data is backed up automatically
- One copy is separate or immutable
- Cloud data is covered
- Last restore test documented with duration
- It is clear who runs the restore in an emergency
Frequently asked questions
How often should we back up?
As often as you can tolerate data loss. Daily automatic backups are a common starting point for working data.
Do Microsoft 365 or Google Workspace back up our data?
Providers ensure availability and offer retention features depending on the plan. Whether that suffices as a backup should be checked against your requirements.
Is an external drive enough?
For very small businesses it can be part of the solution if it is disconnected after backing up and a second copy exists.
Sensible next step
Schedule a restore test for one important file and one whole device, and note how long it takes.
Sources
- Bundesamt für Sicherheit in der Informationstechnik (BSI)
- CISA – Cybersecurity and Infrastructure Security Agency
- NIST Cybersecurity Framework
Checked on 6 Oct 2026.
General orientation – does not replace an individual security review, legal or data-protection advice.