Back up your business data, then prove you can restore it

Your files being “in the cloud” does not tell you what happens after an accidental deletion, a stolen login, or a cancelled account. A useful backup has defined coverage and a recovery method you have actually tried.

Start with the data the business cannot afford to lose. Canada’s Cyber Centre baseline controls recommend secure, encrypted backups of essential information, appropriate isolation and storage, recovery procedures, and restoration tests. The US CISA ransomware guidance likewise emphasizes protected backups and tested recovery. These are operating principles for either country, not a promise about a particular backup app.

1. List what needs to survive

Download the business backup register. Its sample is fictional. Create a row for each data set, rather than treating “the laptop” as the whole business.

Data	Find the actual source	What a test should recover
Website	Source files or repository, images, builder export, configuration notes	A usable copy of a page and its required images
Customer work	Lead tracker, project documents, attachments	A readable record with its related files
Email	Hosted mailbox and its supported export or backup route	A message with an attachment in a usable format
Money records	Invoicing or bookkeeping app, receipts, exports	Original supporting records, not just dashboard totals
Contacts and calendars	Each account or app that holds them	A contact and an appointment with correct details
Recovery procedure	Account ownership, access instructions, provider contacts	Instructions available when the usual device is unavailable

Keep passwords and recovery codes in an appropriately protected system, not this register. Record how an authorized person finds them. See the ownership handoff checklist.

2. Distinguish the copies

Synchronization keeps locations in step. It may copy a deletion or unwanted edit too. Version history can undo some changes, within the provider’s limits. An export is a snapshot of whatever the export includes. A backup is a recoverable copy with defined coverage, protection, and retention.

Those features can complement one another. Ask what survives the failure you are planning for: deleted folders, account loss, device theft, supplier outage, or corrupted files. A repository can help undo website edits, but a copy inside the same compromised account may not survive an account-level incident.

A laptop backup does not necessarily include online-only files, a hosted mailbox, a SaaS database, or attachments held in another app. Inspect the actual coverage. Downloading a contact CSV does not export calendar reminders or every conversation. Ask the provider how to recover the exact data you depend on.

3. Choose how much loss and delay you can tolerate

Write two plain sentences for each critical row:

We can tolerate losing [amount of recent work]. We need a usable recovery within [time].

These are planning targets, not guaranteed service levels. A shop entering orders throughout the day may need a different schedule from a brochure site changed monthly. Set the backup frequency accordingly and include it in the register.

Record how long copies remain available, who checks failed runs, where the copy lives, and what restoring or exporting it costs. Put any paid option through the bill-audit process before buying. An app name and a green status icon do not show whether attachments, metadata, permissions, or old versions are covered.

4. Protect access and a separate copy

Encrypt sensitive backup data, restrict access, and protect the backup account with strong authentication. Keep encryption-key recovery usable: an unreadable encrypted copy will not restore the business. Follow the account security guide.

Plan an offline, isolated, or otherwise separately protected copy appropriate to the risk. A permanently connected drive may be reachable by the same malware as the computer. A second account controlled by the same stolen credentials may share the same failure. CISA’s ransomware resources explain why recovery planning belongs alongside prevention.

Do not keep customer exports in public folders or leave an unencrypted drive in a vehicle. Use only the people and copies needed for the recovery plan. Remove obsolete copies securely according to your retention policy.

5. Restore a sample without overwriting live work

1. Choose a non-sensitive sample: a website page with an image, a test invoice, or a fictional customer record.
2. Restore it to a separate folder or safe test destination using the documented method.
3. Open it. Check text, dates, attachments, links, and formatting that matter to the job.
4. Record the time taken and any missing pieces. “Download succeeded” is not the same as a usable restoration.
5. Correct the coverage or procedure, then repeat the failed part.
6. Record the test date, outcome, responsible person, and next review date.

Choose a repeat schedule that suits the importance of the data. Retest after changing providers, devices, backup settings, or the person responsible. A sample restore is useful evidence about that sample; it does not establish that every record will recover.

6. Write the first steps for an outage

Keep a short procedure available outside the affected device: who decides what to restore, how to find trusted support, where protected access instructions are held, and how customers will reach you temporarily. The site-down guide helps diagnose a domain problem before replacing files unnecessarily.

If compromise is suspected, preserve relevant evidence and get suitable incident-response help before reconnecting or overwriting systems. Restoration does not remove the cause of an intrusion, and a restored file may contain the original problem.

Retention and data location need their own decision

Canada: check the retention and privacy obligations for your records and sector. CRA’s business-record guidance is relevant to tax records; it does not set a universal lifetime for every customer note or backup.United States: IRS recordkeeping guidance covers federal business-tax records. State, contractual, privacy, and sector requirements can add obligations.

For either country, confirm where the provider stores and processes data, who can access it, and whether that arrangement fits your obligations. CAD or USD billing is not evidence of domestic data hosting. Do not retain every personal record forever merely because backup storage is available.

You are finished with the first pass when: essential data is listed, coverage and access are understood, a protected copy exists, a sample has restored successfully, and someone owns the next check.