Backup & recovery guides
Backups that work and getting back up after something goes wrong. 25 plain-English guides for small and medium businesses.
- The 3-2-1 backup rule, explained for a small officeThe 3-2-1 rule says you should keep three copies of your data, on two different types of storage, with one copy somewhere other than your office. For a small business it is the simplest test of whether one bad day can wipe out years of work.
- Backup, sync and archive: three different jobsSync keeps the same files identical across devices, backup keeps older copies so you can go back in time, and archive moves data you rarely use somewhere cheaper but safe. Most small businesses need all three, and trouble starts when one is mistaken for another.
- Why OneDrive or Dropbox on its own is not a backupOneDrive and Dropbox keep your files in sync, but anything that goes wrong on one device, from an accidental delete to ransomware, is copied to the cloud as well. They also sit behind the same login as your live data, so losing that account means losing the files and their history together.
- How to back up Microsoft 365 properlyA Microsoft 365 backup should copy every mailbox, OneDrive, SharePoint site and Team to separate storage at least daily, keep versions for as long as your business needs, and let you restore anything from one email to an entire user. Microsoft's built-in retention helps, but it is not an independent copy.
- Backing up Google Workspace: Gmail, Drive and the restGoogle keeps Workspace running and highly available, but deletions, compromised accounts and departing staff can still lose your data for good. A third-party backup that copies Gmail, Drive, shared drives, Calendar and Contacts every day to separate storage closes that gap.
- Immutable and offline backups: the copy ransomware cannot touchAn immutable backup is locked so nobody, including an administrator, can change or delete it until a set date passes; an offline backup is physically disconnected from your network. Either one means that even if criminals take over your systems, a clean copy survives for you to restore from.
- How often should you back up, and how long should you keep copies?Back up at least daily, and more often for systems where losing a few hours of work would hurt, such as accounting or job management databases. Keep daily copies for a few weeks, weekly copies for a few months and monthly copies for a year or more, then adjust for your legal and client obligations.
- How to test your backups, and how often to do itTest by actually restoring data, not by reading a success report: pick a file, a mailbox or a whole system, bring it back somewhere safe and check it opens and is complete. Do small restores monthly, a larger one quarterly and a full disaster rehearsal at least once a year.
- RPO and RTO in plain EnglishRPO, the recovery point objective, is how much recent work you can afford to lose, measured in time. RTO, the recovery time objective, is how long a system can be unavailable before it seriously hurts the business. Together they decide what backup setup you actually need.
- How to back up a small office server or NASBack up an office server with full image backups so the whole machine can be rebuilt, plus a cloud copy kept offsite; back up a NAS to a separate device and to the cloud, never only to itself. Make sure application databases are backed up in a consistent state, not just copied as open files.
- How to back up laptops used by remote and hybrid staffThe simplest approach is to make sure no work lives only on the laptop: redirect Desktop, Documents and Pictures into OneDrive or Google Drive, then back that cloud data up separately. For staff who need local files, add an endpoint backup agent that copies to the cloud whenever the laptop is online.
- Backing up accounting and practice management softwareFor locally installed accounting or practice software, back up the database in a consistent state every few hours and keep an offsite copy. For cloud software, check what the vendor keeps, export key records regularly, and protect the logins, because the account itself is the biggest risk.
- What drives the cost of cloud backup for a small businessCloud backup cost is driven mainly by how much data you protect, how long you keep it, how many users or devices are covered and how fast you need to restore. Understanding those drivers lets you compare quotes fairly and avoid paying for protection you do not need, or missing protection you do.
- Recovering a deleted file versus recovering a whole officeGetting back one deleted file usually takes minutes and is mostly about having version history and a backup with enough retention. Recovering a whole office after fire, theft or ransomware takes days of planned work and depends on offsite copies, replacement hardware, documentation and a clear order of priorities.
- What a small business disaster recovery plan should containA useful disaster recovery plan lists who does what, which systems matter most and in what order to restore them, where the backups are and how to reach them, and the contacts and credentials needed to act. For a small business it can fit in a few pages, and it should be stored somewhere you can reach when the office and email are both unavailable.
- Business continuity after a fire, flood or theftWhen the office itself is lost, continuity depends on three things being ready beforehand: data held offsite or in the cloud, a way for staff to work from somewhere else, and phone numbers and email that do not depend on the building. With those in place, most small businesses can keep serving clients within a day or two.
- What to do when a hard drive failsStop using the drive straight away, do not run repair tools on it, and check whether the data exists in a backup or the cloud. If it does, replace the drive and restore; if it does not and the data matters, power it down and talk to a professional data recovery service before anyone tries anything else.
- Data recovery services: when they help and when they cannotProfessional data recovery can often rescue files from drives with physical or electronic faults, and sometimes from accidental deletion or formatting. It usually cannot help with data overwritten, encrypted by ransomware without a key, securely wiped, or stored on a cloud account that has been deleted.
- Keeping email and files safe when staff leaveBefore removing a leaver's account, make sure their mailbox and files are either handed to a colleague, converted to a shared mailbox, or captured in a long-term backup. Then remove access and the licence. Doing it in the wrong order is one of the most common ways small businesses lose important records.
- How long should a New Zealand business keep its records?As a general rule, New Zealand businesses keep business and tax records for at least seven years, as Inland Revenue expects. Some records have longer or different requirements, and personal information should not be kept longer than needed, so confirm the details for your situation with your accountant or adviser.
- Encrypting backups: why it matters and how to manage the keysYes, business backups should be encrypted both while they travel and where they are stored, because a backup is a complete copy of your most sensitive information. The harder part is managing the encryption key, since losing it makes the backup useless and storing it carelessly undoes the protection.
- Backup monitoring: making sure someone notices when it failsBackups should be checked every working day by a named person or service, with alerts for failed jobs, missed schedules and devices that have stopped reporting. Most backup failures are silent, so without monitoring a problem can sit unnoticed for months until the day you need to restore.
- Choosing a backup provider: the questions worth askingChoose a backup provider on what it covers, where data is stored, how long it is kept, how fast and easy restores are, how it is secured and who watches it, not on price per gigabyte alone. Asking the same set of questions of each option makes a fair comparison much easier.
- Restoring after ransomware, step by stepIsolate affected devices, call your IT provider and insurer, and preserve evidence before restoring anything. Then confirm the attacker is out, find a clean backup from before the infection, rebuild or wipe affected machines, restore in priority order and reset every password.
- Backup for a small office with no serverAn office with no server still needs backups: an independent daily backup of Microsoft 365 or Google Workspace, any cloud apps holding business data, and laptops whose files are not all in the cloud. The good news is that this setup is usually simpler and cheaper to protect than a traditional office.