Every business plans for backups eventually failing them at the worst possible moment — usually because nobody checks the backup until the day they desperately need it. This checklist is meant to be worked through once, then revisited on a regular schedule, so that "we have backups" actually means something when it counts.

Backup Fundamentals

  • ☐ Follow the 3-2-1 rule. Three copies of your data, on two different types of storage media, with at least one copy stored offsite or offline.
  • ☐ Back up more than just files. Include configurations, databases, email, and any cloud application data your business depends on.
  • ☐ Automate it. Manual backups get forgotten. Scheduled, automated backups don't rely on anyone remembering.
  • ☐ Encrypt your backups. A stolen backup drive shouldn't be an easy win for whoever finds it.
  • ☐ Keep at least one backup offline or immutable. Ransomware actively hunts for connected backups to encrypt — an offline or immutable copy can't be touched.

Testing — The Step Everyone Skips

  • ☐ Actually restore a file, on a schedule. A backup that's never been tested is a guess, not a plan.
  • ☐ Run a full recovery drill annually. Simulate a real failure and time how long full recovery actually takes.
  • ☐ Document the restore process. Write it down clearly enough that someone other than your usual IT contact could follow it in an emergency.

Disaster Recovery Planning

  • ☐ Define your Recovery Time Objective (RTO). How long can your business realistically survive without a given system?
  • ☐ Define your Recovery Point Objective (RPO). How much data loss (measured in time) can you tolerate — an hour, a day?
  • ☐ Identify critical systems first. Not everything needs to come back online at the same time; prioritize what keeps the business running.
  • ☐ Assign clear responsibilities. Everyone involved should know their role during a recovery, not figure it out in the moment.
  • ☐ Keep an offline copy of the recovery plan itself. A plan stored only on the systems that just went down isn't much of a plan.
A backup you've never tested restoring isn't a safety net — it's a hope. Test it before you need it, not during.

Common Mistakes That Undermine Backups

  1. Assuming cloud apps back themselves up. Most cloud productivity platforms are not fully protected against accidental deletion or ransomware without a dedicated backup solution layered on top.
  2. Storing all backups on the same network as production data. If ransomware reaches your network, connected backups are often the first thing it targets.
  3. Never rotating or verifying backup media. Drives fail. Files corrupt silently. Verification catches this before it becomes a crisis.
  4. No documented recovery process. Even great backups are only as useful as your team's ability to actually restore from them under pressure.

How Often Should You Revisit This?

At minimum, review your backup and disaster recovery plan annually, and any time your systems, staff, or critical software change significantly. Pair it with the protections outlined in our ransomware protection guide for a complete picture of business continuity.