Business continuity and backups — a practical guide for small businesses

What if your most important file disappears tomorrow? A practical model for a lean continuity plan: three copies, two storage methods, one off-site. Plus a clear test routine to make sure the plan actually works.

Business continuity sounds like a task for large enterprises. In practice it is simply the answer to: if some important file or system disappears today, how long until operations are normal again? For small companies the question is often as important as for big ones — but answering it requires only a fraction of the resources.

The consequences of a data breach are repeatedly shown to be significant for smaller companies too: revenue may halt for weeks, customer relationships suffer, trust erodes. In addition, a large share of attacks does not aim to steal data but to halt operations through ransomware that encrypts files and demands a payment.

What a continuity plan actually contains

A continuity plan is not an 80-page document. The version that works for a small company fits on two pages and answers four questions.

Which data and systems can the business not be without? Walk through all data, systems and services and split them into three categories: critical (billing, customer registry, accounting), important (internal documents, project data) and side material. Resources are focused on protecting the critical ones.

How long can operations be down? This is technically called recovery time (Recovery Time Objective, RTO). If critical systems can be offline for four hours without major impact, you have four hours to restore from backup. If operations cannot pause at all, you need a more expensive solution where data mirrors in real time to another server.

How much data can be lost? This is the acceptable data loss (Recovery Point Objective, RPO). Day-old backups mean up to 24 hours of data loss. Hourly backups limit it to hours.

Who does what when something goes wrong? Contacts, responsibilities and a timeline — who restores the backup, who communicates to customers, who notifies authorities if needed. Companies under EU's NIS2 directive are required to notify a significant incident within 24 hours.

Three copies, two storage methods, one off-site

The best-known and still-effective backup principle goes like this:

Three copies of the data — original + 2 backups
Two different storage methods — for example cloud + a local disk
One copy physically separated — in the cloud or at a different location

This principle is internationally known as 3-2-1 and is recommended among others by the US technology agency NIST and the cybersecurity agency CISA.

For a small company the practical implementation is almost trivial when Microsoft 365 is in use: the file storage service (SharePoint Online and OneDrive for Business) keeps files in the cloud with version history, providing one copy and a separate location out of the box. The second copy is best ensured with a separate backup service that copies Microsoft 365 data to another location outside it.

An important note: Microsoft 365 is not a backup by default. Microsoft is responsible for the service's availability, but the customer's own data — which can be deleted, overwritten and encrypted — is the customer organisation's responsibility. For this reason a company must take care of backups itself with a separate service.

Ransomware scenario — test for this

If your backup strategy is not tested from a ransomware angle, it is not really protection against ransomware. Ransomware actively seeks out backup servers and encrypts those too — therefore at least one copy must be one that cannot be modified after the fact.

In practice this means a backup storage that is locked against writes for a defined period (immutable storage). Modern cloud backup services offer this out of the box. Combined with verified sign-in to the backup console, access is practically impossible for an attacker even if admin credentials have been exposed.

The practical question to your IT partner is simple: "are our backups protected against ransomware in a way that they cannot be encrypted even with admin rights?" If the answer is not a clear yes, the protection needs to be reviewed.

Restore drill — a backup that is not tested does not exist

The most common and most catastrophic pitfall in SMEs is that backups are configured but never tested. The crisis then reveals that backups are incomplete, the restore takes longer than expected, or some critical systems were not in scope at all.

Practical recommendation: run a restore drill every six months. Pick a random file from a year ago, restore it and measure how long it took. Once a year, test restoring an entire mailbox or file location. Once every two years, simulate a full environment restore from scratch — new user accounts, data restore, email authentication records, certificates. This is heavy but reveals gaps before they cause harm.

Where to start

Building a continuity plan is most effective when done in stages.

Do criticality classification in one afternoon. Gather the key people and walk through the company's data and systems: what is critical, what is important, what is secondary. The output is a listed inventory that guides everything else.
Verify that the three-copy rule holds for critical data. If you use Microsoft 365 and a cloud backup service, the baseline is usually close. Make sure at least one copy is locked against ransomware.
Document a two-page continuity plan. Who does what, how long it can take, how much data may be lost. Include contacts and a customer communication template.
Schedule a semi-annual restore drill. Even a short (30 min) regular test reveals problems before a real crisis.

Business continuity is not a single product or certification, but the organisation's ability to recover from incidents. That ability is built through small, ongoing measures — not through big projects.

Business continuity and backups — a practical guide for small businesses