A Small Business Backup Plan That Survives Ransomware

A dental practice I helped last spring had backups. Every night, a little drive plugged into the reception PC copied the patient files. When ransomware hit on a Tuesday morning, it encrypted the reception PC and that drive in the same eleven minutes. The practice had a backup routine, but not a small business backup plan that could survive an attack, and those are very different things.

Ransomware is now one of the most common serious incidents small firms face, and attackers know that a business with no clean copy of its data is far more likely to pay. The good news is that a backup setup able to survive it is neither exotic nor expensive. For a team of 3 to 25 people, it is mostly a matter of where copies live, who can delete them, and whether anyone has ever tested a restore.

Why Ordinary Backups Fail Against Ransomware

Most small business backups were designed for a dead hard drive or a stolen laptop, not for an intruder. Ransomware behaves differently. Modern strains look for connected drives, mapped network folders and backup software, and try to encrypt or delete copies before triggering the visible attack.

Three setups fail most often:

A USB or network drive that stays plugged in all the time.
A sync folder that faithfully copies encrypted files to the cloud within minutes.
Cloud backups managed by the same administrator account the attacker has already stolen.

File sync is not backup. If a file is encrypted on your laptop, a sync service will often replace the clean cloud copy with the encrypted one.

The 3-2-1-1 Rule for a Small Business Backup Plan

The classic 3-2-1 rule says to keep three copies of your data, on two types of storage, with one copy offsite. For ransomware, add one more requirement: one copy that is offline or immutable, meaning it cannot be changed or deleted for a set period, even by an administrator.

Copy	Where it lives	Protects against
Working data	Laptops, file server or cloud workspace	Daily use
Local backup	NAS or backup server on site	Fast restores, hardware failure
Offsite cloud backup	Separate backup provider	Fire, theft, office loss
Immutable or offline copy	Locked cloud storage or rotated disk	Ransomware and malicious deletion

Many cloud backup services now offer immutability or object lock as a checkbox. Set the retention to at least 14 days, and ideally 30, because attackers sometimes sit inside a network for a week or more before striking.

Decide What You Actually Need Back First

Before buying anything, list what the business cannot run without for a single day. For most small firms the list is short:

Accounting and invoicing data.
Customer or client records.
Shared documents and contracts.
Email and calendars.
Line-of-business software data, such as a booking or practice management system.

For each item, write down two numbers: how much data you can afford to lose, measured in hours, and how fast you need it back. A café can probably survive losing a day of sales notes; an accountant in tax season cannot. Those two numbers decide how often you back up and which copies need to restore quickly.

Cloud Apps Need Backups Too

A common belief is that data stored in a big cloud office suite is automatically safe, so there is nothing to back up. I push back on this one hard. Cloud providers protect their own infrastructure, but their standard retention for deleted or overwritten files is limited, often 30 to 90 days, and an attacker or a careless employee with admin rights can delete mailboxes and shared drives.

A third-party backup of your cloud email and documents, stored with a separate provider under separate credentials, typically costs a few dollars per user per month. For a ten-person firm, that is less than a single hour of downtime.

Lock Down the Backup Itself

An attacker who reaches your backup console can switch off jobs and delete history. Treat backup access as the most sensitive login in the company.

Use a dedicated backup admin account, not anyone's everyday login.
Protect it with a hardware security key or a strong authenticator, never SMS alone.
Limit access to one or two named people.
Turn on alerts for failed jobs and for any deletion of backup data.
Keep backup devices on patched, current software; my case for why software updates matter applies to NAS boxes as much as laptops.

When someone leaves, remove their backup access on the same day. That step belongs on the checklist in offboarding an employee securely.

Test a Restore Every Quarter

An untested backup is a hope, not a plan. Once a quarter, put 30 to 60 minutes in the calendar and restore something real:

One folder of shared documents to a spare location.
One mailbox or a sample of email.
Once a year, a full restore of your most critical system onto a spare machine.

Time each restore. If pulling back 200 GB from the cloud takes two days over your office connection, you need to know that now, not during an incident. Many providers will ship a physical drive for large restores; find out the process and the cost in advance.

Write a One-Page Recovery Sheet

When systems are down, nobody wants to search for instructions on an encrypted server. Print a single page and keep a copy at the office and at the owner's home. It should list who to call first, how to isolate infected machines by unplugging network cables and switching off Wi-Fi, where each backup lives, how to log in to the backup provider, and the order in which to restore systems.

Keep it short enough that a non-technical manager could follow it. If your security habits are still taking shape, start with security a small team can actually follow and fold this sheet into it.

Frequently Asked Questions

How much does a small business backup plan cost?

For a team of around ten people, expect a modest NAS costing a few hundred dollars once, plus cloud backup and cloud app backup totalling roughly 3 to 8 dollars per user per month. Downtime from a single attack usually costs far more.

How often should a small business back up its data?

At least daily for most firms, and every few hours for systems where losing a morning of work would be painful, such as accounting during busy periods or booking systems.

Can we recover from ransomware without paying?

Often, yes, if you have a clean offline or immutable copy that the attacker could not reach. Paying does not guarantee you will get working data back, which is why that protected copy matters so much.

Three Things to Do Before Friday

First, unplug any backup drive that stays permanently connected and find out whether your cloud backup offers immutability. Second, turn on strong two-factor protection for whoever administers backups. Third, book a one-hour restore test in the next two weeks and time it. Those three steps alone move most small businesses from hoping their backups work to knowing they can recover.