The Small Business Backup Strategy That Actually Works

Most small business owners I work with in the Cleveland area fall into one of two categories: they have no backup system at all, or they have one they've never actually tested. Both situations are equally dangerous. A backup you can't restore from isn't a backup — it's just false confidence.

The good news is that setting up a real, working backup strategy doesn't require expensive software or a dedicated IT staff. It requires understanding a few principles and then doing the work once to set it up correctly.

The 3-2-1 Rule — and Why It Matters

The industry standard for backup strategy is called the 3-2-1 rule. It's simple:

• 3 copies of your data
• 2 different storage media types
• 1 copy stored offsite (or in the cloud)

Why three copies? Because any single backup can fail. Hard drives fail. Cloud accounts get locked. USB drives get lost. The third copy is your insurance against two simultaneous failures, which happen more often than you'd expect — especially when disaster strikes and multiple things go wrong at once.

Why different media types? Because a ransomware attack that encrypts your main drive will often also encrypt any drive that's connected to the same network. An external USB drive that's plugged in 24/7 counts as the same media for this purpose. You want at least one copy that a ransomware script can't reach.

Why offsite? Fire, flood, theft. If all three copies are in your office and the building burns down, you lose everything. An offsite copy — even a cloud backup — breaks that chain.

What You Actually Need to Back Up

Before you set anything up, spend ten minutes thinking about which data would hurt most to lose. For most small businesses, this list looks like:

• QuickBooks or accounting files
• Customer records, CRM data, or a contacts database
• Project files, contracts, and invoices
• Email archives (if stored locally, not just in Gmail/Outlook 365)
• Business-critical documents: insurance policies, LLC paperwork, vendor agreements
• Any proprietary templates, scripts, or tools your business runs on

Notice what's not on that list: the operating system and installed software. You can reinstall Windows and reinstall QuickBooks. You cannot recreate five years of customer data. Back up data, not software.

Also pay attention to where your data actually lives. If your team uses Google Workspace or Microsoft 365, most of your data is already in the cloud — but that doesn't mean it's backed up. Google and Microsoft both disclaim responsibility for data loss caused by user error or account compromise. A separate backup of your cloud data is still a good idea.

Setting Up an Automated Backup — Step by Step

Manual backups don't work in practice. People forget, get busy, or skip the step when they're in a hurry — which is exactly when the next disaster is most likely to strike. Automate everything you can.

For Windows users, here's a simple, reliable setup:

1. Cloud backup first. Sign up for Backblaze Personal Backup or Microsoft OneDrive (included with Microsoft 365). Install the agent on every computer that holds important data. Set it to back up continuously or at least nightly. Cost: $0–$10/month per machine.
2. Local backup second. Get an external hard drive (at least 2x the size of your data — a 1TB drive runs $50–$70). Use Windows' built-in File History or a free tool like Macrium Reflect Free to schedule nightly backups to the drive. Keep the drive disconnected from the network when not actively backing up.
3. Verify it works. This step is skipped 90% of the time. Once a month, actually open a backed-up file from each system and confirm you can read it. Once a quarter, try a full restore drill — can you get a machine back to a working state from the backup alone?

Ransomware-Proofing Your Backup

Ransomware is the scenario that breaks the most backup strategies. Modern ransomware doesn't just encrypt your current files — it actively looks for connected backup drives and cloud sync folders and encrypts those too. If your "backup" is a mapped network drive or a folder synced to Dropbox in real time, ransomware can reach it just as easily as your originals.

To protect against this:

• Keep at least one backup completely air-gapped — disconnected from the network, or using a service that retains older versions for 30+ days (Backblaze does this by default).
• Enable versioning on your cloud storage. OneDrive, Google Drive, and Dropbox all support file versioning, but you may need to enable or extend the retention window. Without versioning, ransomware can overwrite your cloud copy before you notice anything is wrong.
• Rotate your local backup drive. Instead of one external drive, use two and alternate them weekly. Keep one offsite (at your home, a safe deposit box, etc.). This gives you a copy that's at most one week old and physically disconnected from anything ransomware could reach.

How Much Does This Actually Cost?

For a typical 1–5 person Cleveland small business, a solid 3-2-1 backup setup runs $100–$200/year in software costs plus a one-time $50–$150 hardware purchase. That's it. Compare that to the average ransomware recovery cost for a small business, which runs $50,000–$200,000 when you factor in downtime, data recovery attempts, and potential ransom payments.

The ROI on a proper backup system is essentially infinite. The only question is whether you set it up before or after the loss event.

If your current backup situation is "we should probably do something about that," now is the right time to act. At Tevis Engineering Solutions, we help Cleveland-area businesses set up automated, tested backup systems that fit their existing workflows. If you'd like help getting this configured correctly — and verified — submit a support ticket and we'll get started.