Backups & Encryption Guide for Small Businesses
Ransomware doesn't ask if your last backup was three weeks ago. It attacks, encrypts your files and demands payment — or just deletes them entirely.
Key statistic: According to Veeam's 2022 Ransomware Trends Report, only one in six organisations properly test whether their backups can actually restore data. That means 83% of businesses with "backups" have no idea if those backups will work when they need them most.
The 3-2-1 Backup Rule
This is the gold standard every business should follow. It's simple, proven and it works.
Keep 3 copies of your data
Original, plus two backups. One copy lives on your main system, one on a separate device or network and one off-site:
- Your working files (production data)
- A local backup on a NAS, external drive or separate server
- An off-site copy in the cloud or at another physical location
Use 2 different storage types
Don't put all your eggs in one basket. Mix local and cloud, or use different hardware so a single failure can't take everything:
- NAS or external drive (local / on-premise)
- Cloud backup service (Azure Blob, AWS S3, Backblaze, etc.)
Keep 1 copy off-site
If your office floods, burns or gets hit by ransomware that spreads across the network, your cloud copy is untouched and ready to restore:
- Encrypted cloud backup (always encrypted in transit and at rest)
- Physical drive stored off-site for critical data
The Even Better Version: 3-2-1-1-0
A modern twist adds two more rules. One copy should be immutable or air-gapped (cannot be modified or deleted, not even by ransomware). And your restore process should achieve a 0-error rate in testing, meaning you've actually verified the backup works end to end.
What I Set Up for Your Business
From Microsoft 365 email protection to full server imaging and encrypted off-site storage, here's what a proper backup setup looks like:
- Cloud Backup: Azure Blob or AWS S3 backup targets with automated daily incremental backups.
- Local Backup: NAS or external drive for fast local restores when you need them urgently.
- Email Protection: Microsoft 365 email backup so you don't lose client correspondence if something goes wrong.
- Server Imaging: Full system images that let you restore an entire server from scratch in hours, not days.
- Encrypted Off-Site Storage: Always encrypted data stored geographically separate from your primary location.
The Reality Check: What Businesses Get Wrong About Backups
Mistake #1: "I have backups, so I'm protected." Having backups doesn't mean they work. If you haven't tested a restore in over 12 months, you don't know if your backups are usable.
Mistake #2: "The cloud does it automatically." Microsoft 365 doesn't back up your data for disaster recovery — it protects the platform. You're still responsible for your own backup strategy.
Mistake #3: "Ransomware will never target me." According to Veeam's research, 94% of ransomware attacks specifically target backup repositories. If you have backups, they'll be targeted.
The Simple Question
When was the last time you actually restored data from your backup and confirmed it worked?
If it's been more than 12 months, or you're not sure, that is a problem worth fixing now.
The Verdict: Who Needs This?
If your business has data — and every business does — you need a backup strategy. Not a "we'll sort it out later" approach, but something set up properly with tested restore processes.
Bottom line: Ransomware doesn't ask if your last backup was three weeks ago. Get it right from the start with professional setup and regular testing. It saves money long term, reduces risk significantly, and means you can focus on running your business instead of recovering data at 2am.