"We have backups." It's the most dangerous sentence in IT. Because having backups and having recoverable backups are two very different things.
We've walked into more than one business that thought they were protected, only to discover their backup hadn't actually completed in months. Or the backup was running, but it was backing up the wrong folders. Or the backup file was corrupted and couldn't be restored.
A backup you've never tested is just a hope — not a plan.
What Can Go Wrong
Here are real scenarios we've seen with small businesses in Central Florida:
The backup that wasn't running. A dental office had backup software installed but the scheduled task had been silently failing for 11 weeks. Nobody checked because "it was set up."
The backup that was incomplete. A construction company's backup was running every night — but it was only backing up one of three critical folders. The other two (including their accounting database) were never included.
The backup that couldn't restore. A law firm's backup files were intact, but when we tried a test restore, the data was corrupted. The backup had been writing bad data for months.
The backup on the same server. A medical office was "backing up" to a second hard drive in the same server. When the server failed, both drives were gone.
In every one of these cases, the business thought they were protected. They weren't.
What a Real Backup Strategy Looks Like
A proper backup setup follows the 3-2-1 rule:
- 3 copies of your data (the original plus two backups)
- 2 different types of storage (e.g., local device + cloud)
- 1 copy offsite (so a fire, flood, or ransomware can't reach all copies)
But the rule alone isn't enough. You also need:
Regular test restores. We restore files from backup on a scheduled basis to verify the data is intact and the process works. Not just a "backup completed" notification — an actual restore of actual files.
Monitoring and alerts. Every backup job is monitored. If a backup fails or misses its window, we know about it immediately — not weeks later.
Recovery time planning. How long would it take to get your business running again if your server died right now? If you don't know the answer, you don't have a disaster recovery plan — you have a backup folder.
Encrypted, immutable backups. Modern ransomware specifically targets backup files. Your backups need to be encrypted and stored in a way that ransomware can't reach or modify them.
What We Back Up
For every client, we ensure coverage across:
- Server data — file shares, databases, applications
- Microsoft 365 — email, SharePoint, OneDrive, Teams (yes, Microsoft can lose your data too — their responsibility ends at infrastructure uptime, not your data)
- Line-of-business applications — your practice management software, accounting system, whatever your business runs on
- Workstation data — for key machines that store local files
The Test You Should Run Today
Ask your current IT provider (or yourself, if you're the IT person) these three questions:
- When was the last test restore performed? If the answer is "never" or "I don't know," that's your answer.
- What exactly is being backed up? Can they show you the list of folders and systems included?
- How long would recovery take if our server died today? If they can't give you a number in hours, there's no recovery plan.
Your backups are the safety net between your business and a catastrophe. Make sure the net actually holds.