Most small businesses we talk to will tell you they have backups. When we ask when they last tested a restore, the answer is usually a pause. That pause is the difference between having a backup and having a recovery plan — and it's the single most expensive mistake we see.
The 3-2-1 rule: what it is and why it matters
The 3-2-1 backup rule has been the gold standard for decades, and it still holds up: keep 3 copies of your data (production plus two backups), on 2 different types of media (e.g. local server and cloud, or NAS and external drive), with 1 copy offsite. The logic is simple: one failure shouldn't take out everything. If the building burns down, the offsite copy survives. If a hard drive fails, the server copy is still there.
Most SMBs fall short on at least one of the three. The most common gap is the offsite copy — they back up to an external hard drive that sits on a shelf next to the server. A fire, flood, or break-in takes out production and the backup in one event.
The restore test nobody does
A backup you haven't tested is a wish, not a plan. We've seen backup jobs that reported “completed successfully” every night for months — and when the business needed them, the files were corrupted, or the backup software had been backing up the wrong folders, or the backup drive itself had failed silently weeks earlier.
Testing a restore doesn't mean recovering your entire production environment. It means picking a handful of files — a shared folder, a QuickBooks company file, a few client documents — and confirming you can pull them back from the backup and open them. If you can't do that in under 30 minutes, your backup process has a hole in it.
We recommend testing restores quarterly at minimum, and documenting the results. Write down what you restored, when, and whether it worked. This isn't busywork — when something goes wrong at 8 PM on a Friday, your future self will thank you for having written instructions instead of figuring it out under pressure.
Ransomware targets your backups first
Modern ransomware doesn't just encrypt your production files. It actively hunts for backup files, backup drives, and connected cloud backup folders, and encrypts those too. Attackers know that if they can destroy your backups, you have no choice but to consider paying the ransom. Any backup that's connected to your network at the time of the attack is at risk.
This is why immutable or air-gapped backups matter. An immutable backup cannot be modified or deleted for a set retention period — even by the backup software or an administrator. An air-gapped backup is physically disconnected from the network. Both approaches prevent ransomware from reaching your backup data. Most cloud backup services now offer immutability as a configurable option, and it should be enabled.
The three most common backup mistakes
- ✓Never testing restores. A backup report that says “success” is not the same as actually recovering a file and opening it.
- ✓All backups in one physical location. If your server and your backup drive are in the same room, one event takes out both.
- ✓No immutable or air-gapped copy. If ransomware can reach your backup, it will. Immutability or physical separation is not optional anymore.
Cloud backup solves multiple problems at once
A properly configured cloud backup service gives you automatic offsite storage, file versioning (so you can roll back to a point before the ransomware hit), and immutability options. It also eliminates the “someone forgot to swap the backup drive” problem, because it runs on a schedule without human intervention. For a typical small business, cloud backup is often the most cost-effective way to close all three gaps in the 3-2-1 rule at once.
Industry research suggests that roughly 60% of SMBs that experience catastrophic data loss shut down within six months. Whether the exact number is 60% or not, the pattern is well-established: businesses that can't recover their data rarely survive. Invoices, client records, financial history, email archives — these aren't just files. They're the operational memory of your business. Losing them is not something most small companies can recover from.
If you take one thing from this article, make it this: schedule a restore test this week. Pick three files, restore them, and confirm they open. If they don't, you just found the problem before it found you.