Most small offices believe they have backups until the day they need one. A laptop is stolen, a NAS drive fails, or ransomware encrypts the shared folder, and it turns out the "backup" was a sync folder that faithfully copied the damage. Good backup and disaster recovery for small business is not complicated, but it has to be deliberate. This checklist walks through what to protect, how many copies to keep, and how to prove that a restore actually works.

Step 1: List Everything That Holds Business Data

Start with an inventory, not with software. Walk through the office and your accounts and write down every place where work is created or stored. In a typical Long Beach or Los Angeles office of five to fifty people, the list looks like this:

  • Cloud mailboxes and files: Microsoft 365 or Google Workspace mail, OneDrive, SharePoint, Google Drive and Teams chats.
  • A NAS or file server: shared folders, scanned documents, design files, project archives.
  • Line-of-business applications: accounting files, practice management or CRM databases, often on one "special" PC in the back office.
  • Laptops and desktops: files saved to the desktop or Downloads folder that never reached the server.
  • Configuration: firewall and router settings, camera recorder settings, website files and DNS records.

A common surprise: Microsoft and Google keep your cloud services running, but they are not a complete backup of your data. Deleted items age out, and a compromised account can remove files that then sync everywhere. A separate microsoft 365 backup (or Workspace backup) that keeps its own history is worth adding to the list.

Step 2: Apply the 3-2-1 Backup Rule for Small Business

The 3-2-1 backup rule for small business is simple: keep three copies of important data, on two different types of storage, with one copy away from the office. In practice that often means the live data, a local backup device, and a cloud copy.

Ransomware has added one more requirement. Attackers now look for backup shares and delete them before encrypting anything. At least one copy should be offline or immutable: a drive that is disconnected after each run, or a cloud immutable backup that cannot be changed or deleted for a set period, even by an administrator account. Ask any provider of small business backup solutions exactly how their product handles this.

Step 3: Decide How Much You Can Lose and How Long You Can Wait

Two questions shape every disaster recovery plan for small business, even if the technical names (RPO and RTO) never come up:

  • How much work can we afford to redo? If backups run once a night, a failure at 4 p.m. means a full day of changes may be gone. For an accounting database, that may be unacceptable; for an archive folder, it is fine.
  • How long can we be down? Restoring a single file is quick. Rebuilding a server, reinstalling software and copying back large volumes of data takes much longer. If the business cannot operate without that system, plan for a faster path, such as a spare machine or the ability to run a server image temporarily.

Write the answers down for each system from Step 1. They decide how often backups run and how much you should invest in each one.

Step 4: Schedule Restore Tests

A backup that has never been restored is a hope, not a plan. Knowing how to test a backup restore is the single most useful skill in this whole checklist, and it is simple:

  • Monthly: restore a few random files from different sources to a separate folder and open them. Check that spreadsheets, PDFs and database files are readable, not just present.
  • Quarterly: restore a full mailbox or a complete shared folder, and time how long it takes.
  • Yearly: run a larger restore test of a server or a critical PC to spare hardware or a virtual machine, and confirm that the application actually starts and the data is current.

Keep a short log of each restore test: date, what was restored, how long it took and any problems. That log is also useful for cyber insurance questionnaires, which increasingly ask how backups are verified.

Step 5: Watch the Reports, Not Just the Software

Backups fail quietly: passwords change, cloud tokens expire, disks fill up. Someone must read the success and failure reports every week, and alerts should go to more than one inbox.

Questions to Ask a Backup Provider

Whether you are comparing business data backup services Los Angeles firms offer or looking for data backup Long Beach businesses can rely on locally, these questions separate a real service from a software license:

  • Which of our systems will you protect, and which will you leave out?
  • Where is each copy stored, and is at least one copy offline or immutable?
  • How long do you keep versions, and can we recover a file from several weeks ago?
  • Who reads the backup reports, and how will we hear about failures?
  • How often do you perform restore tests, and will you show us the results?
  • If the office is unusable, what is the step-by-step plan to get staff working again?

Our team in Long Beach sets up and maintains data backup, migration and disaster recovery services for Los Angeles and Long Beach offices, from Microsoft 365 backup to NAS and server protection with documented restore tests.

A One-Page Summary to Keep

Good backup and disaster recovery for small business fits on a single page: the systems, where each copy lives, who checks the reports and when the last restore test happened. Keep a copy outside the office and review it after any big change.

Backup Checklist FAQ

Is syncing files to OneDrive or Google Drive a backup?

Not on its own. Sync copies changes, including deletions and encrypted files, to every device. It helps with availability, but you still need a separate backup with its own version history.

How often should a small office test a backup restore?

Restore a few files monthly, a larger folder or mailbox quarterly, and a full system at least once a year. Also test after any major change, such as a new server or a move to the cloud.

Do we need a disaster recovery plan if all our data is in the cloud?

Yes. Accounts can be compromised, files can be deleted, and staff still need working laptops and internet access. A short written plan covers who does what and in which order when something goes wrong.