3-2-1 backups for a small office on a small budget

Guide type

Setup guide + worksheet

Risk if skipped

High

Time

2 hours to set up

Cost

One external drive + cloud storage you may already pay for

For

Offices of 1–25 people

Last verified

2026-10-05

What can go wrong without backups

Event	What you lose without a separate copy
Ransomware	Every file the infected computer can reach, including synced cloud folders and connected drives
Laptop stolen or dead disk	Anything that was only on that device
Someone deletes the wrong folder	The folder, everywhere it syncs, once the recycle bin is emptied
Account hacked or closed	Everything in the email and cloud account
Fire, flood or burglary	Every computer and backup drive in the building

CISA's ransomware guide puts it plainly: keep offline, encrypted backups of critical data, and regularly test that you can restore them. Many ransomware attacks search for connected backups and delete them first.

Step 1: list what you actually need

Backups fail most often because nobody knew a file lived somewhere unexpected. Spend 20 minutes listing:

• Documents: shared drives, desktops, "Downloads" folders where invoices pile up.
• Email: especially if it is the only record of agreements and invoices.
• Accounting and payroll: desktop software files, or exports from the online service.
• Customer data: CRM, booking system, online shop.
• Things that are hard to recreate: contracts, design files, photos, licence keys, the website.

Use the worksheet below to record where each one lives and how it is backed up.

Step 2: build the three copies

1. Copy 1 is your working data

   The files on your computers, a shared drive, Google Drive or OneDrive. Syncing is convenient but it is not a backup: a deletion or an encrypted file syncs too.

2. Copy 2: an automatic backup to an external drive

   Buy an external drive with at least twice the space of the data you are protecting. On a Mac, turn on Time Machine (System Settings › General › Time Machine) and tick the option to encrypt the backup; it keeps hourly, daily and weekly versions. On Windows, use File History (search for it in Control Panel) to save versions of your files to the drive. For a shared office folder, a small network storage box (NAS) with its own snapshot feature does the same job for everyone.

3. Copy 3: off-site, and out of reach of ransomware

   Either a cloud backup service with version history or immutable storage (old versions cannot be changed or deleted for a set time), or a second external drive that you swap every week and keep at home, disconnected. A disconnected drive cannot be encrypted by malware.

4. Back up the cloud services too

   Google says plainly that its Vault tool "isn't a data archive", and Microsoft's services agreement recommends that customers regularly back up content they store on its services. Options: a third-party backup for Google Workspace or Microsoft 365, or at minimum a regular export (Google Takeout, Outlook export) saved into your backup.

5. Encrypt anything that leaves the office

   A backup drive holds everything a thief would want. Turn on encryption when you set up the backup, and store the password in your password manager, not on a sticky note in the drive's box.

Your backup worksheet

Click any cell to edit it. The worksheet is saved on this device only. Print it and keep a copy with your incident plan.

Step 3: test a restore every quarter

1. Pick one real file and one whole folder

   Choose something that changes often, such as this month's invoices.

2. Restore them to a different location

   From the external drive and from the off-site copy. Restore to a new folder so you do not overwrite current work.

3. Open the files and note the time it took

   If a restore takes a day, that is a day the business cannot work after a disaster. Write the date in the worksheet's last column.

Budget options that work

Office	Copy 2	Copy 3	Rough cost
1–3 people, files mostly on laptops	One external drive per laptop, automatic backup	Second drive swapped weekly and kept at home, or a personal cloud backup plan	Drives only, plus an optional small monthly fee
3–10 people, shared cloud drive	External drive or small NAS with snapshots	Cloud-to-cloud backup for Google Workspace or Microsoft 365	A per-user monthly fee for the cloud backup
10–25 people, local server or NAS	NAS snapshots plus a USB drive for the NAS	Immutable cloud backup of the NAS	Storage costs by the terabyte; ask for versioning and immutability

We do not recommend specific backup products in this guide because we have not tested them. When comparing services, ask four questions: does it keep old versions, for how long, can old versions be deleted from a hacked account, and how fast can you download everything?

Backups are item 11 of our small business cybersecurity checklist. They are your safety net when everything else fails, but the cheaper fix is to avoid the infection: train the team to spot phishing links, the most common way ransomware gets in.

Sources

• CISA — Data backup options (PDF)
• CISA — #StopRansomware guide
• Google — Vault overview
• Apple — Back up your Mac with Time Machine
• Microsoft — Microsoft Services Agreement
• NCSC (UK) — Backing up your data