A backup checklist for a small business.

The Australian Signals Directorate’s handbook for small business says a backup plan should answer six questions: what is backed up, when, where the copies are stored, who manages them, how long they are kept and how often they are tested. This checklist follows those six. Work through it with whoever looks after your IT. Any line you cannot tick is a job for this month.

What is backed up

Start with a list of every place the business keeps information. The handbook singles out email and cloud accounts as places to check.

• Every location is on the list: the server or shared drive, each laptop, email, Microsoft 365 or Google Workspace, the accounting and booking systems, and the website.
• Each one has a backup named beside it, or a note saying why it is left out.
• The backup covers software and settings as well as files, so a computer or server can be rebuilt and put back to work. The Essential Eight wording is “data, applications and settings”.
• Someone updates the list when a new system or a new staff member is added.

Check what each cloud provider keeps for you, because it has limits. Microsoft says a file deleted from SharePoint stays in the recycle bin for 93 days. Google says an administrator can recover a Drive file for 25 days after the user empties their bin. Past those limits, both say the file cannot be recovered. The Australian Signals Directorate suggests putting a plain question to every provider: do they back up your data, or do you need to?

When it runs

• Backups run automatically. Nobody has to remember to start one.
• The schedule matches how often the files change and how much work you could afford to redo. For some businesses that is every night, for others every hour.
• A failed or skipped backup sends an alert to a person who will act on it.
• Systems that depend on each other, such as a booking system and the accounts it feeds, are backed up together so they can be restored to the same moment.

Where the copies are kept

The short form is the 3-2-1 backup rule: three copies, two kinds of storage, one somewhere else. Check your own setup against it.

• At least one copy is in a different building from the original.
• At least one copy is offline, or stored so that it cannot be changed or deleted for a set period. The Australian Signals Directorate advises disconnecting a backup drive when it is not in use.
• Backups are encrypted, and the password or key is kept where a second person can find it.
• The backup device gets its own software updates, like any other computer in the office.

Who is responsible

• One named person owns the backups, and a second person can step in when the first is away.
• Ordinary staff accounts cannot change or delete backups. The Essential Eight asks for this at its first maturity level.
• If an outside provider runs the backups, you know where the copies are stored and you hold your own record of how to reach them.

How long copies are kept

A backup that holds only last night’s copy is no help with a mistake made last week. A file overwritten on Monday may not be missed until someone opens it at the end of the month, and by then every recent copy contains the same mistake.

• The backup keeps earlier versions, and you know how far back they go.
• That period is longer than the time a problem could go unnoticed in your business.
• It also covers the records you are required to keep. Your accountant can tell you how long that is.

How often it is tested

A backup has not proved anything until something has been restored from it. How to run that test, and what to look for, is in A backup you have never restored is a guess. For this checklist, two lines are enough.

• The next restore test is in the calendar, with a name against it.
• The result of the last test is written down, including how long the restore took.

Put the answers on one page

Write the six answers on a single page. Add the name of the backup service, where the passwords are held and who to call. Keep a printed copy away from the office, because the day you need it may be the day the computers are not working. business.gov.au suggests recording your backup procedures in the business’s emergency management plan, and reviewing that plan regularly.

Regular backups are one of the Essential Eight, the Australian Government’s baseline for cyber security. The free Essential Eight assessment shows where you stand on the other seven. If you would like someone else to run the backups, watch them and test the restores, that work is described under Data Management.