Best practices for secure data backup

Data backup best practices come down to four habits: keep several copies in more than one place, make at least one copy impossible to change or delete, protect the backup system as carefully as the data, and prove you can restore. The first habit is common. The other three are where recoveries tend to fail.

For our clients, server backups run hourly, are copied off-site daily, are immutable and are verified by screenshot. Microsoft 365 and Google Workspace data is backed up three times a day and is immutable too, and all backups are stored in the US.

What data backup best practices protect against

Backups used to be about hardware failure. Today the bigger threat is an attacker who finds your backups first and deletes or encrypts them before launching ransomware. The ordinary causes of data loss haven’t gone away either:

• Drives, servers and laptops that wear out without warning.
• Someone deleting the final version of a file or emptying the wrong folder.
• A departing employee who deletes a client list or a mailbox.
• Ransomware that encrypts your files and goes after your backups.
• Storms, fire and flooding. In south Louisiana, hurricane season makes an off-site copy essential.
• Cloud or vendor outages that make your data unreachable.

Step 1: Follow the 3-2-1 rule

CISA’s guidance for small and mid-sized businesses uses the 3-2-1 rule as the baseline: three copies of important files (the live data plus two backups), on two different types of storage, with one copy off site.

A local copy handles fast restores for everyday mistakes. The off-site copy protects you when the building, the server room or the whole network is the problem. CISA’s list of what to include is a good checklist: client records, employee and HR files, financial and payroll data, email, websites and line-of-business databases, and configuration files and software settings. Write down where each one lives so nothing gets missed when you add a system.

Step 2: Make one copy immutable or offline

Immutable storage locks a backup for a set period so nobody, including an attacker with admin rights, can change or delete it. An offline copy is disconnected from the network entirely. The FBI and CISA give the same core advice: keep off-site or offline backups, encrypt them, and make sure they can’t be altered or deleted. Our ransomware guide covers how attackers hunt for backups.

Step 3: Lock down the backup system

• Encrypt backups in transit and at rest, so a stolen copy is useless.
• Give the backup console its own credentials, separate from your main admin accounts, and require MFA for every login.
• Send failure alerts to someone who will act on them the same day.

Step 4: Keep enough history

Ransomware can sit undetected on a network before it runs. CISA recommends being able to roll back at least seven days. Longer retention gives you more clean restore points, and it also has to satisfy any legal or contract retention rules for your records.

Step 5: Back up Microsoft 365 separately

Under Microsoft’s shared responsibility model, you are always responsible for your data, your accounts and who can access them. The built-in recycle bins help with small mistakes. In SharePoint, deleted items are kept for 93 days and then permanently removed. That won’t help with a mistake found four months later, an insider who empties the recycle bin, or a compromised account that encrypts synced files.

A dedicated backup of Exchange mailboxes, OneDrive and SharePoint, including Teams files, closes that gap. Microsoft now offers its own Microsoft 365 Backup service, and third-party options exist. Our Microsoft 365 services include backup setup.

Step 6: Back up device configurations

Firewalls, switches, wireless controllers and phone systems hold settings that took hours to get right. Back them up automatically after every change, keep encrypted copies off the device, and track changes so an unexpected edit can be rolled back. CISA also recommends current golden images of standard servers and workstations so you can rebuild quickly.

Step 7: Test restores

A green checkmark tells you a job finished. It doesn’t tell you the data is usable or how long a restore takes. Restore a few files and a mailbox every month, restore a full server or key application at least once a year, and compare the time it took with how long the business can actually be down. Write the steps down so recovery doesn’t depend on one person.

Common backup mistakes

• Treating OneDrive or SharePoint sync as a backup. Sync copies deletions and ransomware encryption to every device.
• Keeping the only backup drive in the same room as the server.
• Using the same admin account for the network and the backup system.
• Never testing a full restore, only single files.
• Forgetting new systems added since the backup plan was written.

Backup rules if you keep sensitive records

The HIPAA Security Rule requires covered entities and business associates to keep retrievable exact copies of electronic protected health information, have procedures to restore lost data, and periodically test and revise their contingency plans. Any backup vendor that stores patient data needs a signed business associate agreement. We hold signed BAAs with every vendor that can touch PHI. Our healthcare IT page covers how this fits a practice.

Accounting firms, financial advisors and law firms have similar duties under the FTC Safeguards Rule, client confidentiality rules and record-retention requirements. Cyber insurers ask about backups too, as our post on what cyber insurance covers explains. Document your schedule, retention and test results so you can show the plan works. Backup is one piece of a larger plan, which our guide to the essentials of a business continuity plan and our hurricane checklist walk through.

Ask when your last full restore test happened and how long it took. When nobody can answer, that is the place to start: book an intro call to talk through how our business continuity services would back up and verify your systems.

Sources: CISA, Back Up Business Data; CISA, #StopRansomware Guide; FBI IC3, 2025 Internet Crime Report; Microsoft Support, Restore items deleted from SharePoint or Teams; Microsoft Learn, Microsoft 365 Backup overview; eCFR, 45 CFR 164.308 Administrative safeguards; Microsoft Learn, Shared responsibility in the cloud.