The 3-2-1 backup rule calls for three copies of your data across two types of storage, with one copy off-site. For a small business, this reduces the chance that a hardware failure, a site emergency or an accidental deletion affects every copy.
Decide which data you need to protect
List what your team would need on the first day after an incident. Include customer records, accounting data, shared files and any configuration needed to bring key applications back. Ask each team how many hours of changes it could afford to redo. If the answer is two hours, a daily backup leaves a gap you need to address.
Separate copies and access
A business might keep working files on a server, one backup on a dedicated device and another with an off-site service. Check that losing one site or compromising one account would leave another copy available. Limit restore permissions to designated staff and plan for an isolated copy. Sync can carry a deletion across devices, so verify recovery options before you count a synced folder in your plan.
Time an actual restore
Restore a folder to a separate location and ask its owner to confirm that the files are complete and usable. Record the recovery time and the age of the backup. Repeat with a critical application so the exercise covers its dependencies. The Canadian Centre for Cyber Security recommends testing restore procedures regularly.
Related article How to build a small business IT disaster recovery plan