Published on October 20, 2026 · The mitza.es team
Almost every business has “backups”. Few have ever checked that they can be restored. And that difference is what separates a bad day from a serious problem: a failing disk, an employee who deletes a folder, a compromised account or a ransomware attack. This guide explains how to set up a small business backup using simple criteria, without buying anything complicated.
Why backups fail just when you need them
The most common failures aren't technical, they come down to how the backup was planned:
- The copy sits on the same computer or the same disk as the original data, so both are lost at once.
- The copy is always connected to the network, so ransomware encrypts it along with everything else.
- Nobody has ever tried restoring it, and they find out it was incomplete or corrupt when it's already too late.
- The obvious files (documents) get copied, but not email, databases, the website or the configurations.
- The person who set it up left the company and nobody knows where it is or how to recover it.
The 3-2-1 rule, in plain words
It's the best-known guideline and the most practical one for a small business:
- 3 copies of your data: the original plus two more copies.
- 2 different media: for example, a disk or a NAS and a cloud service, so that a single failure can't affect all of them.
- 1 copy off-site: in the cloud or in another location, to survive a theft, a fire or a flood.
There's a reinforced version usually called 3-2-1-1-0: it adds a copy that is disconnected from the network or immutable, meaning it can't be modified or deleted for a set period, and zero errors when verifying the backups. That “air-gapped” copy is the one that saves you when an attacker gets into your systems.
What to back up
- Documents and working files, both on computers and on servers or shared folders.
- Email and calendars, if you don't have a copy of your own beyond the service you use.
- Databases and business software: invoicing, accounting, CRM.
- Your website or online store, with its files and its database.
- The configurations and keys needed to get everything up and running again.
One important nuance: having your data in a cloud service doesn't always mean you have a copy of your own. Check your provider's terms to find out what they keep, for how long, and what happens if you delete something by mistake or someone accesses your account without permission.
How often and for how long
Two questions settle it. The first: how much work are you willing to lose? If you lose your computer today at five o'clock, is it enough to recover this morning's work, yesterday's or last week's? That determines the frequency. The second: how long can you afford to be down while you restore? That determines what kind of backup you need and where to keep it.
It's also worth keeping several versions, not just the latest. If a file gets corrupted or encrypted and last night's backup already copied it that way, you need to be able to go back to the one from the week before.
How to protect yourself from ransomware
Attackers know backups are your way out, and they go after them first. That's why the offline or immutable copy is the most important one. On top of that: use separate credentials for the backup system, turn on two-step verification, and don't leave the backup drive permanently mounted on work computers. If you want to understand how they get in, we cover it in our guide on ransomware in Spanish businesses.
Testing the restore: the part nobody does
A backup that has never been restored is a hope, not a backup. Schedule a regular restore test: recover a single file, a whole folder and, at least once a year, an entire computer or service in a test environment. Write down how long it took and what went wrong. That note is worth more than any automatic “backup successful” report.
Backups of your website or online store
If you have a website, you need two things backed up: the files and the database. And not on the same server: if the hosting fails or you get hacked, the copy stored inside is lost along with it. Ideally it's kept off the server and someone checks from time to time that it can be restored. It's one of the tasks included in our website maintenance, along with updates and security monitoring.
Backups are personal data too
If your backups contain customer or employee data, they're subject to the GDPR. Article 32 requires appropriate technical measures and, among them, the ability to restore the availability of and access to personal data in a timely manner in the event of an incident. In practice: encrypt your backups, limit who can access them and define how long you keep them.
Checklist for your business
- I know where all my backups are and who is responsible for them.
- I follow the 3-2-1 rule, with at least one copy outside the office.
- I have a disconnected or immutable copy.
- I back up email, databases, website and configurations, not just documents.
- I keep several versions, not just the latest.
- Backups are encrypted and access is restricted.
- I've tried restoring something in the last six months.
- Someone besides the person who set them up knows how to recover them.
If you answer “no” to several, start with the restore test and the off-site copy: they're the two that matter most. And if you'd rather have someone go through it with you, a website security audit is a good first step for your website, and in Valdemoro and the surrounding area we also help with the IT maintenance of your office.
Frequently asked questions about business backup
Is an external drive enough?
An external drive is a good starting point, but on its own it's a single copy in the same place. Add a copy outside the office and, if you can, another one disconnected from the network.
Does a RAID count as a backup?
No. A RAID protects against a single disk failing, but not against accidental deletion, a virus or ransomware: whatever is deleted or encrypted on one disk is deleted or encrypted on the other.
Is the cloud better, or your own disk?
Each covers something different. A disk or NAS restores faster; the cloud protects against theft, fire and office failures. The 3-2-1 rule calls for combining both.
How often should I test the restore?
At a minimum, a partial test every few months and a full one at least once a year, and whenever you change system or provider.