Many businesses think about backups only after an important file is deleted, a computer fails, or a system becomes unavailable. At that point, the question is no longer “do we have a copy?” but “can we restore the right data, the right version, at the right time?”. A backup is therefore not simply copying data for reassurance. It is an operating capability that helps a business continue after disruption.
Start with the assets that genuinely keep work moving: customer records, contracts, accounting data, active project files, system configurations, and access inventories. NIST describes contingency planning as coordinated plans, procedures, and technical measures for recovering systems, operations, and data after disruption. The backup list should therefore reflect business priority, not merely disk capacity (NIST).
Start with recoverability
For each important data set, answer four short questions: where is it stored, who owns it, how long can work continue before the loss becomes material, and to what point in time must it be restored? A sales team may be able to restore a weekly report the following day, while same-day orders and delivery information may need to return much sooner. These answers guide backup frequency and recovery order when resources are limited.
The first system does not need to be complex. A simple register recording the data set, original location, backup location, frequency, accountable person, and last restoration test turns “someone probably handles it” into an observable responsibility. When software, vendors, or access rights change, update this register as part of the operational change.
Do not confuse synchronisation with backup
Folders synchronised across devices are useful for collaboration, but they do not automatically provide an independent recovery copy. A mistaken deletion, overwritten file, or locked account can spread to synchronised copies. The business should therefore identify at least one copy separated from the day-to-day working environment and control who can alter or remove it. CISA guidance stresses protected, offline backups that are tested regularly because ransomware can seek out and delete accessible backups (CISA/MS-ISAC Ransomware Guide).
This does not require every business to buy many tools immediately. The first objective is risk separation: maintain more than one copy, place copies where they do not depend entirely on the same device or account, and assign someone to check them. The appropriate setup will differ between a small advisory team and a business with operational systems, but the principle of independent recovery remains the same.
Test restoration before you need it
A copy that has never been opened again is only an assumption. Each month, choose a sample folder or file, restore it to a safe location, and check three things: whether it opens, whether the needed version is present, and how long the accountable person takes to complete the task. Record the result, problems encountered, and the corrective action. NIST includes testing, training, and exercises in the maintenance cycle for contingency plans; CISA recommends regular backup testing.
A 60-minute exercise can be enough to begin: list the five most important data sets; assign an owner to each; check where the copies sit; restore one file as a test; and record the next check date. Once this becomes a regular working rhythm, backup is no longer only an IT task. It is a clear commitment that the business knows how to resume operations when something goes wrong.
References
National Institute of Standards and Technology. Contingency planning.
CISA & MS-ISAC. Ransomware Guide.
Illustration: thiago japyassu / Pexels.
