Do cloud files still need backups, and what backup setup should a small business use?

Business Tech & Tools

Do cloud files still need backups, and what backup setup should a small business use?

The short answer

Yes. Syncing a folder to the cloud helps with access and collaboration, but it is not the same as keeping an independent backup. A bad edit, accidental deletion, ransomware change, account lockout, or sync mistake can affect the cloud copy too.

A sensible small-business setup keeps the working files in one approved cloud service, makes an automatic backup to a different destination, and keeps another protected copy that is not always connected to the working account. Test a restore every month. A backup you have never opened is only a hope.

Know what each layer protects

Layer Main job What it may not solve
Cloud sync Keeps current files available across devices Can copy a deletion or damaged file to every device
Version history Rolls one file back to an earlier state May have time, plan, file-type, or administrator limits
Deleted-file recovery Rescues recently deleted items Does not promise indefinite recovery
Separate backup Creates another recovery path Fails if it is never run, protected, or tested
Offline or isolated copy Helps when connected systems are damaged Can become stale if the schedule is ignored

Do not count a second synced laptop as a full backup. If the same account controls both copies, one mistake or account problem may reach both.

Build the plan around how much work you can lose

Ask, “If everything disappeared at 3 p.m., how far back could I afford to restart?” If losing one business day would be painful, a weekly backup is not enough. Important client work may need daily or more frequent protection. A folder of old brand photos may not.

Make a short inventory:

  • active client deliverables.
  • signed agreements and approvals.
  • bookkeeping exports and invoices.
  • website files and content.
  • email or CRM exports when the service does not provide another recovery route.
  • passwords and recovery codes, stored through a secure method.
  • templates, photographs, and source files that would be expensive to recreate.

Do not automatically back up every download, cache, or duplicate. Know what matters and where the authoritative copy lives.

Use a three-copy pattern

For important data, aim for:

  1. the live working copy.
  2. an automatic backup on a different system or destination.
  3. a separate copy that is offline, isolated, or otherwise protected from changes to the live account.

CISA's current small-business material recommends knowing what to back up and following a 3-2-1 approach. See its small and medium-sized business resources. The exact technology can be modest: a reputable backup service plus a disconnected encrypted drive may be enough for a one-person business, depending on the sensitivity and volume of the files.

An external drive left permanently connected is easier for you to use, but it may also be reachable by malware or an accidental deletion. Disconnect it after the backup, protect it from theft and damage, and store an off-site copy when a fire or flood could destroy both the computer and the nearby drive.

Test the restore, not just the green checkmark

Once a month, choose a small folder that includes a document, image, spreadsheet, and one larger file. Restore it to a temporary location and verify that each file opens. Do not overwrite the live folder during the test.

Record:

  • date and person who ran the test.
  • files restored.
  • time the restore took.
  • errors or missing permissions.
  • whether file dates and versions made sense.
  • change needed before the next test.

NIST's small-business recovery guidance emphasizes automatic backups, multiple locations, and testing that restored information can actually be read. Review NIST's recovery guidance for the underlying reasoning.

Protect the backup account too

Use a unique password, turn on multifactor authentication, save recovery codes securely, and restrict administrative access. Encrypt portable drives when appropriate. Make sure a former contractor cannot open the backup destination after her work ends.

If you keep health, financial, identity, children's, or other regulated information, ordinary consumer storage may not meet your duties. Check current contractual, industry, and local requirements and get qualified security or legal help where the risk deserves it.

Finally, write a one-page recovery note: where the backups are, how to restore one file, how to restore the whole business, and who to call. Store a protected copy somewhere you can reach when your main computer and account are unavailable.

Sources and further reading

A free next step

You don't have to build this alone

Bring your questions, share what you're working on, and meet other women building businesses from home. It is free to join.

Join Our Community Free

Related Questions

← All questions