A backup folder stored on the same computer as the working files is not enough protection against ransomware, hardware failure or theft. If the computer and its local copy fail together, the business can lose both the original and what it thought was a backup.
The 3-2-1 Rule, Explained Simply
CISA’s own guidance is specific: three copies of important files, on two different types of storage, with one copy kept off-site. For a small business, that’s realistically the working laptop, an encrypted external drive, and a protected cloud or genuinely off-site copy — three separate points of failure, not one drive wearing three hats.
What to Protect First, in Order
- Accounting and tax records
- Customer and supplier contacts
- Contracts and invoices
- Product and inventory data
- Website and creative files
- Account-recovery information itself
Keep One Copy Genuinely Isolated
A drive that remains permanently connected to a compromised computer can also be affected, depending on the attack and the access available to it. Disconnect the backup drive after each scheduled backup where practical, or use a cloud service with protected version history and real access controls instead.
Encrypt Anything Sensitive
A backup creates a brand new privacy risk if it’s ever stolen. Encrypt sensitive data, restrict who can access it, and store recovery keys somewhere separate and controlled — not taped to the drive itself.
Test the Restore, Not Just the Backup
Topic hub: Explore more in Technology Guides for Nigerian Users.
Every month or quarter, actually restore a sample file to a different location and open it. Write down the date, who did it, and what happened. A backup job marked “successful” can still produce a corrupted or incomplete file — you only find out by actually testing, not by trusting the green checkmark.
A simple backup schedule for a small team
Files that change every day should not depend on a backup someone remembers to run once a month. Decide which folders need automatic daily protection, which larger archives can be copied weekly, and who is responsible for checking that restoration still works. Document the recovery steps so the business is not dependent on one employee remembering where everything lives.
Keep multiple, genuinely independent copies. Test the restoration, not just the backup schedule. The goal was never to say a backup exists — it’s to actually get the business running again when the original is gone.
