Back Up Business Data

Know what to back up. 

Start by taking inventory of what important information resides on your network. This will give you an understanding of what you are protecting and who has access. A simple spreadsheet can help you track what you’re backing up. 

Focus on sensitive and business-critical data such as: 

• Customer and client records
• Employee and HR information
• Financial and payroll data
• Emails and critical communications
• Configuration files and software settings
• Website and operational databases  

Pay attention to how your data flows at rest and in transit, user behavior and activities, and what devices are involved. This gives you a solid baseline for security testing, continuous monitoring and security-based decisions.  

Identify what data your business can’t operate without, like proprietary research, development files or financial records, and prioritize those for protection. 
 

Follow the 3-2-1 backup rule. 

Once you know what needs to be protected, it’s time to set up your backups. The 3-2-1 rule is a trusted guideline: 

• 3 copies of important files
• 2 different types of storage media (like a hard drive and the cloud)
• 1 copy stored off-site, away from your business location 

Choose a backup solution that runs automatically and regularly. Regular backups protect against ransomware and malware attacks. Use a combination of on-site and remote backups to protect against threats, hardware failures and physical damage. 
 

Secure, test, and train. 

Leverage protections for backups, including physical security, encryption and offline copies. 

Test backup procedure to make sure your team can rapidly restore data both fully and partially, and to ensure you can roll back data at least seven days if needed.  Know how to access critical files even without an internet connection. If using industrial control systems or operational technology, conduct a test of manual controls to ensure that critical functions remain operable if the organization’s network is unavailable or untrusted.  

Finally, train your team. A backup plan is only helpful if everyone knows how to use it. Write down your procedures and make sure your team can recover systems, networks and data from your backups. Everyone plays a part in data protection!