Small Business Backup Strategy: A Practical Setup Guide for 2026

A friend of mine runs a small architecture firm. Six employees, about 15 years of project files — AutoCAD drawings, client contracts, thousands of emails. One Tuesday morning, their office manager opened an invoice attachment from what looked like a known vendor. By lunchtime, every file on their server and every connected computer had a .locked extension. The ransom demand was $18,000.

They did not pay. By 4 PM that same day, they had restored everything from backup and were back at work. The ransomware cost them about six hours of downtime and a few hundred dollars in IT support. Why? Because their backups were set up correctly — and they had tested them.

This guide is about making sure you have that same outcome if it happens to you. No theory, no enterprise-speak — just what to do and how to do it.

What to Back Up: The Three Buckets

Before buying tools or setting schedules, figure out what actually needs protecting. I think about it in three buckets:

Bucket 1: Files You Cannot Recreate

These are the things that would put you out of business if they disappeared:

• Customer lists, contracts, proposals, and invoices
• Financial records, tax documents, payroll data
• Project files, design documents, source code — anything you created
• Email archives (yes, emails — people forget these)

Rule: Back up daily, keep multiple versions, store one copy offsite. This is your highest priority.

Bucket 2: Systems You Can Rebuild (But Do Not Want To)

Things you could technically recreate from scratch, but it would take days or weeks:

• Computer configurations, installed software lists, license keys
• Website files and databases
• CRM and accounting software data (most of this lives in the cloud — verify that)

Rule: Back up weekly at minimum. Document your software licenses and configurations somewhere that is not on the same computer.

Bucket 3: Cloud Data You Assume Is Backed Up (It Is Not)

This one catches people off guard. Google Workspace and Microsoft 365 protect against their infrastructure failing. They do not protect against you accidentally deleting files, an employee going rogue, or ransomware encrypting your synced cloud folders. If you delete a file in Google Drive and do not notice for 30 days, it is gone.

Rule: Use a third-party cloud backup tool. We will cover specific options below.

Tools: What to Use at Each Budget Level

I have set up backup systems ranging from "zero dollars, using what you already have" to "fully automated with monitoring." Here is what I recommend at each level:

Zero-Budget Setup (Solo or 2–3 People)

The catch: Someone has to remember to plug in the drive and run the backup. Set a recurring calendar reminder for every Friday at 4 PM. If you miss two weeks in a row, something is wrong.

Standard Setup (3–20 People)

Bonus: Set up Veeam's email notifications. If a backup fails, you get an email within minutes. This is the single most important configuration — a backup that silently fails is not a backup.

Hands-Off Setup (If You Never Want to Think About It)

Is it worth paying $5–10/device/month? If you are reading this guide and feeling overwhelmed, yes. The peace of mind of knowing someone else is making sure your backups run is worth the cost.

How to Set It Up: The Saturday Afternoon Plan

Here is exactly what to do, in order. Block off 3–4 hours on a Saturday.

Hour 1: Inventory

1. Make a list of every computer, server, and cloud service your business uses.
2. For each one, write down what data lives there and which bucket it falls into.
3. Identify anything that is only stored on one person's computer. Move it to a shared location or add that computer to the backup list.

Hour 2: Set Up Local Backup

1. Download and install Veeam Community Edition on one computer (this will be your "backup manager").
2. Plug in your external drive or connect to your NAS.
3. Create a backup job: select which folders on which computers to back up, set the schedule (daily at 2 AM for servers, daily at noon for employee laptops), and point the destination to your drive or NAS.
4. Enable "immutable backups" in Veeam's settings. This creates a "compliance lock" period during which even an administrator cannot delete the backup files.

Hour 3: Set Up Offsite Backup

1. If using a NAS: install the NAS's cloud sync app (Synology has Cloud Sync built in). Connect it to Backblaze B2 or Wasabi. Set it to sync every night at 3 AM.
2. If using an external drive: buy a second drive, back up to it on Fridays, and take it home. Swap the two drives each week. This is old-school but extremely effective.

Hour 4: Test It

1. Pick a random file — ideally something you have not touched in months. Restore it from backup to a different location. Open it. Verify the contents are correct.
2. If it does not work, fix the issue now — not when you are in the middle of a ransomware recovery.
3. Write down the restore procedure. Be specific enough that someone else could follow it. Store this document somewhere that is not on the computer you are backing up.

The Testing Schedule Nobody Actually Does (But Should)

I am going to be honest: most people never test their backups. They set them up, they assume they are working, and they find out the truth on the worst day of their business. Here is the minimum testing schedule I recommend:

• Monthly: Open your backup software and verify the last backup shows "Success." Check that the file count looks reasonable (if your backup normally covers 50,000 files and this month it says 500, something is wrong).
• Quarterly: Actually restore a file. Pick something random — last year's tax return, a client contract from six months ago, anything. Restore it to your desktop, open it, and verify it works.
• Annually: Do a full disaster recovery drill. Pretend your main computer or server is completely dead. Can you restore everything to a different machine? How long does it take? This tells you your real Recovery Time Objective.

Put these on your calendar. Right now. I will wait.

Common Backup Mistakes I See All the Time

1. The "always plugged in" external drive. If your backup drive is permanently connected, ransomware will encrypt it along with everything else. The drive must be physically disconnected between backups, or you must use immutable cloud storage.
2. Backing up to the same computer. If your backup lives on the same hard drive or same computer as your working files, a hard drive failure destroys both. This sounds obvious, but you would be surprised.
3. Only backing up files, not systems. If your accounting software's database is on your computer but your backup only covers the Documents folder, you are not actually protected. Think in terms of "what do I need to get back to work," not "what files do I have."
4. Thinking cloud sync is backup. Dropbox, Google Drive, and OneDrive sync changes in real time. If ransomware encrypts a file on your computer, the encrypted version syncs to the cloud. Most cloud storage keeps deleted/changed files for 30 days, which gives you a window — but 30 days goes by fast. A real backup keeps multiple historical versions.
5. Never testing the restore. I cannot emphasize this enough. The backup is not the goal. The restore is the goal.

Keep Going

A good backup strategy is not complicated, but it does require consistency. Set it up once, test it once, and then the only ongoing work is a five-minute check each month to make sure it is still running. The alternative — losing years of business data and having no way to get it back — is infinitely worse.

The architect friend I mentioned at the beginning? He still emails me every few months to say thanks. His words: "I did not realize how close we came to losing everything until I saw the look on the IT guy's face when he said 'your backups are clean.'"

Do not wait until you need the backup to find out if it works. Set it up this weekend.