A small business backup not working can mean a failing job, or a backup that cannot bring you back: a system was left out, the copy is too old, or one attack or deletion reached it too. Watch the job alerts, test a restore, keep one copy beyond your everyday sign-ins, and decide what you can afford to lose.
I have worked in IT and development since 1998 and earned vendor certifications in cloud backup and disaster recovery between 2021 and 2024, which have since expired. This guide draws on the backups and restore rehearsal we ran for our own website in October 2026. Reviewed 13 October 2026 by Derick Payne.
Why does a small business backup stop working?
Backup software reports whether a job ran. Watch those alerts, because some failures show there first. Others only show when you try to recover:
- The job fails quietly. A full disk, an expired password or a moved folder stops the backup, and nobody reads the warning.
- Something was never included. A laptop, a shared mailbox or an accounting database sits outside the backup set.
- The copy is too old. A weekly backup means losing up to a week of work.
- The restore is too slow. The data comes back, but after days, not hours.
- The backup went down with the original. It sat on a drive that was plugged in, in the same account, or with the same provider, so one attack or one deletion took both.
How do you test whether your backup works?
Restore something, and time it. Microsoft’s reliability guidance says “it’s critical to test your backups and restoration processes”. A test a small office can run:
- Pick three things: one file, one mailbox or folder, and one whole computer or server.
- Restore each to a separate place, never over the live copy. Restore a whole computer or server into an isolated test network, with its email, integrations and scheduled jobs switched off, so it cannot act on live systems.
- Open what came back in the program that uses it, check the date of the newest data, and check something the business relies on, such as last week’s invoices in the accounting system.
- Time the restore itself, and estimate the whole outage around it: noticing the problem, deciding to restore, getting replacement equipment if needed, the restore, and checking the business can work again.
- Write down the result, the date and who ran it, and repeat on a schedule.
If any step fails, your backup is not working yet, whatever the software says.
What did our own backups teach us?
In October 2026 we moved our website to a new data centre. Before we retired the old setup, we backed up the new site in three parts: a database export on the server, and the host’s own database backup and file backup. We recorded each file’s checksum, then restored the host’s database and file backups together into a separate copy of the site and checked that five key pages loaded. The restore passed, before we ever needed it.
The old site taught the harder lesson. Its backups were kept by the same host, attached to the site itself. We had downloaded and checked them too, then deleted those downloads because they held form submissions and private uploads. When the old site was deleted on 11 October 2026, no final backup was kept anywhere else, and the host’s backups could no longer be reached. Its last content, drafts, comments and form entries went with it. A backup that lives with the thing it protects can disappear with it.
Is the 3-2-1 rule enough?
The 3-2-1 rule is the right start. The UK National Cyber Security Centre (NCSC) describes it as “at least 3 copies, on 2 devices, and 1 offsite”.
It is not enough on its own, and the NCSC says why: the rule “does not require any backup location to be offline”. Copies in different places can still share one weak point. The NCSC has seen ransomware encrypt “the connected USB and network storage drives holding data backups” and compromise “connected cloud storage locations containing backups”. The US Cybersecurity and Infrastructure Security Agency (CISA) ransomware guide adds that “many ransomware variants attempt to find and subsequently delete or encrypt accessible backups”.
So keep at least one copy isolated from the accounts, passwords and systems that could damage the live data. That can be a drive you disconnect, or a backup service that an attacker cannot delete from with the same sign-in. The NCSC’s principles for ransomware-resistant cloud backups describe the goal: “an attacker who has compromised a system can’t make destructive requests without compromising another separate system.” Then test recovery from that copy too.
Does Microsoft 365 back up your data?
Not in the way most people assume. Microsoft runs the service, but its shared responsibility model says you “always retain” responsibility for your data. What Microsoft 365 keeps for you is limited in time:
- Deleted email: once a message is removed from Deleted Items, or deleted with Shift+Delete, Exchange Online keeps it in the Recoverable Items folder for 14 days by default, and an administrator can raise that to 30. Holds and retention policies can keep it longer.
- Deleted files: work OneDrive accounts keep deleted files for 93 days, unless an administrator changed the setting, and SharePoint keeps them for 93 days from deletion.
Those are the normal windows, not guarantees. SharePoint’s site recycle bin can purge its oldest items early when it exceeds its quota, and an administrator can empty it. After deletion from the recycle bins, Microsoft keeps backups for 14 more days, and an administrator can ask Microsoft Support for a restore in that time. That route restores a whole site collection, not a single file, list or library. Retention policies your administrator set can keep content longer. Check your own tenant’s settings rather than assume. Microsoft 365 Backup, Microsoft’s own backup for Exchange, SharePoint and OneDrive, is “a pay-as-you-go offering” billed separately, and other backup services do the same job. If your email and files matter, back them up like any other system.
How much data can you afford to lose, and for how long?
Decide two numbers for each system before something goes wrong. Microsoft defines them as the recovery point objective, “the maximum duration of acceptable data loss”, and the recovery time objective, “the maximum duration of acceptable downtime”.
In plain terms: how much recent work can you lose, and how long can you wait? An accounting system that can lose an hour needs backups at least every hour. A shop that cannot trade for more than half a day needs a whole outage, restore included, that fits inside half a day. The answers set how often you back up and what you spend, and they turn the restore test into a pass or a fail.
What does load-shedding mean for backups now?
Load-shedding has paused: Eskom said South Africa had gone 504 consecutive days without it by early October 2026. Load reduction still affects some high-risk areas, and local outages happen for other reasons.
A sudden power cut can still interrupt a backup halfway or damage a file that is open. Give servers and network storage a UPS that shuts them down safely, check the next backup after any outage, and keep one copy away from the office, so a surge or a break-in cannot reach every copy.
Does a backup protect you from ransomware?
A tested, protected backup is one of your most important recovery measures. It does not prevent the infection, and it does not undo the theft of data. CISA’s guide describes “double extortion”, where attackers “exfiltrated victim data and pressured victims to pay by threatening to release the stolen data”. A restore can get your systems back; it cannot recall copies an attacker already has. After an attack, restore only once the incident is contained and investigated. Pick a backup from before the attacker got in, because the NCSC warns that ransomware may have replicated to backups before being discovered, and restore into clean systems. CISA’s guide warns: “Take care not to re-infect clean systems during recovery.”
The risk is real here. INTERPOL’s Africa Cyberthreat Assessment Report 2025 charts 12,281 ransomware detections in South Africa in 2024, second in Africa after Egypt. Those are one security company’s detections (Trend Micro’s), not a count of every attack. Prevention (updates, multifactor sign-in, monitored security software) and recovery both belong in the plan. If there are reasonable grounds to believe personal information was accessed or acquired by someone unauthorised, POPIA’s breach rules apply too; our POPIA checklist covers them.
What does a working backup plan look like?
| System | How often | Where the copies live | How you prove it works |
|---|---|---|---|
| Files and shared folders | Often enough to meet your data-loss number | A local copy and one isolated copy off-site | A file and a folder restored, dated and timed |
| Email and Microsoft 365 | Daily or better, beyond Microsoft’s own windows | A separate backup service | A mailbox restored to a separate place |
| Accounting and other databases | Matched to the data-loss number, often hourly | Off-site, isolated from the server’s sign-ins | A full restore, with the whole outage measured against your downtime number |
| Laptops | Daily, or files synced to a backed-up store | Not only on the laptop | One laptop rebuilt from backup |
| Your website | Daily or real-time | Away from the hosting account as well | A restore into a separate copy |
For each row, also write down how long copies are kept, because a problem found late needs a version from before it started. Name who receives the failure alerts and what they do about them. And keep the recovery passwords and encryption keys somewhere you can reach if your everyday accounts are lost.
How do we handle backups?
For clients, backups for the systems in their scope are tested by restoring from them on a set schedule, and the client gets the result. Our own website is backed up in real time by a backup service. The October 2026 rehearsal above restored the launch backups and checked five pages; it did not test a restore from that real-time service, which needs its own test. The old site’s lost backups are why this guide tells you to keep a copy away from your host before anything is retired.
FAQ
How often should a small business test a restore?
On a schedule you write down, and after every big change, such as a new server, a new backup tool or a move to the cloud. CISA says to test backups “regularly”; choose a rhythm you will keep, and record each result.
Is OneDrive or Dropbox sync a backup?
Not on its own. Sync sends changes in synced folders to the cloud account and to every device set to sync them, including deletions and files encrypted by ransomware. The recycle bin and file history help for a while, but a separate, isolated backup is what you restore from when sync has spread the damage.
Is a cloud backup enough without a local one?
It can be, if it is isolated and you have timed a full restore over your internet line. A large restore over a slow line can break your downtime number, which is why many offices keep a local copy as well.
What should you do next?
Check your IT basics with the free IT health check: ten plain questions, including backups. Then run the restore test above on one file, one mailbox and one computer. If it fails or takes too long, our managed IT covers backup and recovery, tested by restoring. If you are moving systems to the cloud, plan the way back first: see what goes into a cloud migration rollback plan. And when you compare providers, ask when they last restored a backup.
Published 16 June 2026. Last updated 13 October 2026.