An untested backup is a hope, not a plan

Most small businesses say they have backups, but far fewer can say when the last one ran, where it is stored, or whether anyone has ever restored a file from it.

The Canadian Centre for Cyber Security includes backing up data among the 13 baseline controls it recommends for small and medium organizations. It earns its place on that list as the measure that lets you recover from a failed update, a deleted folder or a ransomware attack without paying anyone.

Four questions worth answering

1. If your website went down right now, who would notice first, you or a customer?
2. When did your last backup run, and where is it stored?
3. Has anyone ever restored a file from it?
4. Does your security certificate renew automatically, or could it quietly expire over a long weekend?

What a reliable backup setup looks like

• Backups are stored separately from the original files, since sync tools copy deletions and mistakes to every connected device.
• Backups run automatically, as any task that depends on someone remembering will eventually be skipped.
• At least one copy lives off-site, away from both your office and your web host.
• Backups are tested by restoring a file every quarter, which is the only way to know that they work.

The 3-2-1 rule in plain terms

A widely used rule of thumb for backups is known as 3-2-1. You keep three copies of your important data, on two different kinds of storage, with one copy somewhere off-site. For a small business, that might mean the files on your laptop, a cloud backup service, and an external drive that is connected once a week and then put away.

Backing up your website

Most hosting plans include backups, so find out how far back they go and how to restore one, and keep a copy of your own as well. Security certificates are now replaced every few months, which means renewal has to be automatic. It also helps to set up a simple uptime monitor that emails you if the site stops responding.

A worked example

Imagine a three-person design studio that keeps all of its work in a synced cloud folder. One afternoon a laptop picks up ransomware, which scrambles the files in that folder. The sync tool copies the scrambled versions to every other laptop and to the cloud, and the studio discovers that its three copies were really one copy repeated three times.

Now picture the same studio with a separate backup service that keeps daily versions for 30 days. The team wipes the infected laptop, restores the previous day's versions, and loses an afternoon instead of a client list.

What to back up

• Email should be included, since Microsoft 365 and Google Workspace keep deleted items recoverable for only a limited time.
• Accounting data should be backed up wherever it lives, and you should know how to export it.
• Your website needs both its files and, if it has one, its database.
• Shared drives belong in the backup too, especially contracts, designs, photos and anything you would struggle to recreate.

Questions to ask your web host

1. How often are backups taken, and how long are they kept?
2. How do I restore a backup, and how long does it take?
3. Are backups stored separately from the website itself?
4. What happens if the security certificate fails to renew?
5. What are your support hours if the site goes down?

Security certificates in brief

The padlock in a visitor's browser shows that your site uses HTTPS, which encrypts the connection between their device and your server. Certificates expire and are now replaced every few months, so automatic renewal is essential. After switching to HTTPS, check for mixed-content warnings, which appear when a page still loads an image or script over plain HTTP.

Why this matters more each year

Fortinet's 2026 threat report ranked Canada as the second most-targeted country for ransomware in 2025. When ransomware locks your files, a recent and tested backup is the difference between a bad day and a bad month.

Common mistakes

• Treating a sync folder as your only backup.
• Keeping the backup drive permanently connected, where ransomware can reach it.
• Never restoring anything, so that nobody knows the process or whether it works.
• Sending renewal notices for hosting and certificates to an old or unchecked inbox.

Frequently asked questions

Is cloud storage a backup?

Cloud storage on its own is not a backup. Sync services copy every change, including deletions and damage, whereas a backup keeps older versions separately so that you can return to them.

How often should a small business back up its data?

Anything that changes every day should be backed up daily and automatically, while files that rarely change can be backed up weekly.

Should we pay if ransomware strikes?

Paying does not guarantee that your files will come back, and it marks your business as one that pays. A recent, tested backup means you never have to make that decision. Report any incident to the Canadian Anti-Fraud Centre and to your local police.