Small Business Backup Plan: What to Back Up First
Prioritise small‑business backups by financial, customer and rebuild impact, protect Tier 1 data first, and remember that SaaS services like Microsoft 365 and Google Workspace are not backed up by the vendor.
When a ransomware attack or a hard‑drive failure wipes a small business’s files, the first question is which data the business can survive without. The answer is to back up by business impact, not by what is easiest to copy.
How to decide what to protect
A practical backup plan ranks data in three tiers. The ranking follows three criteria that matter to any small business:
- Financial or legal exposure, data whose loss could bring fines, lawsuits or lost revenue.
- Customer impact, data that directly affects the service you provide to clients.
- Re‑create time, how long it would take to rebuild the data from other sources.
The tiering system works as follows:
| Tier | What belongs here | Why it matters |
|---|---|---|
| Tier 1 | Financial records, compliance reports, customer contracts and any data required by law | Loss would cause immediate financial loss, regulatory penalties or damage to reputation |
| Tier 2 | Core operational files, employee records, contracts, email archives and shared work documents | Affects day‑to‑day operations and staff productivity |
| Tier 3 | Device‑level data such as personal desktop files, cached copies and data that can be regenerated from other sources | Impact is limited and recovery can be delayed |
Photo by Brett Sayles on Pexels
The tier order also decides recovery speed, you do not need to bring every file back online at once, only the most critical data first.
Why SaaS platforms need your own backup
Most small businesses store data in SaaS services such as Microsoft 365, Google Workspace and cloud‑based accounting apps. The providers keep the service running, but they do not back up the customer’s data. Deleting a file or a mailbox in Microsoft 365, for example, can be permanent after the retention window closes, and a compromised login can delete large amounts of data faster than any built‑in undo feature. The same applies to Google Workspace, where deletions are often irreversible.
Because the vendor’s responsibility stops at availability, you must treat SaaS data as any other on‑premise data and include it in your backup plan.
Core backup actions for each tier
- Immutable backups for Tier 1, store a copy that cannot be altered or deleted. This protects against ransomware that tries to encrypt or erase existing backups.
- Automated daily schedules for Tier 1 and Tier 2, set the backup software to run without manual intervention. Regular scheduling is essential for the backups to be effective.
- Weekly backups for Tier 3, a lower frequency is acceptable because the data can be recreated.
- Off‑site or cloud copy, keep at least one copy outside the primary site to survive fire, theft or ransomware that reaches the local network.
- One‑test restore, periodically restore a single file from each tier to confirm the backup works and that you can meet recovery‑time objectives.
Practical steps to get started
- Identify Tier 1 data, list all financial statements, tax files, compliance reports and customer contracts. Begin protecting only this set to keep the first commitment small.
- Enable immutable storage, most backup solutions, including the Veeam Data Platform, offer an immutable option for on‑premise or cloud targets.
- Configure automated jobs, create separate backup jobs for each tier with the frequencies shown above.
- Add an off‑site destination, a cloud bucket or a secondary data centre works well; the exact location is less important than having a copy that is physically separate.
- Schedule a monthly test restore, pick a random file from Tier 1, restore it to a different location and verify its integrity.
- Export SaaS data regularly, set up scheduled exports from accounting platforms and store the files in your Tier 1 backup set.
- Migrate personal drive work to shared drives, shared drives are easier to back up centrally and reduce the risk of orphaned personal copies.
Photo by panumas nikhomkhai on Pexels
Cost considerations
Backup cost grows with three factors: the amount of data, the length of retention and the number of platforms you protect. Starting with Tier 1 only limits early spend while you prove the process works.
Terms used in this article
- SaaS, software delivered over the internet where the provider hosts the application and data.
- Immutable backup, a backup that cannot be changed or deleted for a defined period.
- Retention window, the time during which deleted items can still be recovered by the service.
As a Veeam partner, we have tested these practices with the Veeam Data Platform and Veeam Data Cloud, which provide the immutable and off‑site capabilities described above.
