Most small businesses that lose data don’t lose it in a fire. They lose it because someone deleted a folder six weeks ago and nobody noticed, because a departing employee’s account was removed, or because ransomware encrypted the file server and the backup drive plugged into it. A backup plan that only anticipates hardware failure misses all three.
The working answer is short. Follow the Canadian Centre for Cyber Security’s 3-2-1 rule — three copies, two media types, one off site — keep at least one copy offline or immutable, write down how much data you can afford to lose and how long you can afford to be down, and prove it by restoring something on a schedule. Everything below is detail on those four points.
Backup, retention and disaster recovery are three different things
Backup is a separate copy of your data that you can restore from. It answers “the file is gone” or “the server is dead.”
Retention is how long you keep things, and how far back you can reach. A backup that only holds last night’s copy answers nothing about the spreadsheet that was quietly corrupted in August. Retention is also where legal, tax and client obligations live.
Disaster recovery is the plan for continuing to operate. Microsoft defines disaster recovery as planning how you respond to uncommon, major events, and lists natural disasters, major human error such as accidentally deleting production data, and major security incidents like ransomware among them. It covers people, premises and processes, not just data. Where will staff work? Who calls the insurer? How do you take payments with the office network down?
Most small businesses have some backup, vague retention and no disaster recovery. The gap usually shows up at the worst moment: the data is fine, and the business still can’t operate.
The 3-2-1 rule, and why one copy has to be offline
The Cyber Centre’s backup guidance is direct: “Adopt the 3-2-1 rule for data storage and have 3 copies of your information (1 original and 2 backups), saved on 2 different media types, with 1 copy kept off site.” It also says to encrypt sensitive data and to test the recovery process on a routine basis.
The part people skip is the offline copy. The Cyber Centre explains why it matters: because offline backups aren’t connected, “they remain unaffected by many cyber threats, like ransomware, that can compromise all systems and devices on your network.” The Cyber Centre’s baseline controls say long-term backups, such as weekly ones, must be stored offline, while frequent ones, such as daily backups, may stay online.
Offline doesn’t have to mean a drive in a drawer. Immutable storage achieves the same thing — Microsoft defines immutability as storage that can’t be altered, deleted or overwritten for a specified period of time. Either way, apply one test: if your main administrator account were compromised right now, which copy would survive? If the answer is none, you don’t have an offline copy, whatever the product brochure says.
What Microsoft 365 and Google Workspace do and don’t protect
Both platforms are highly resilient at the infrastructure level, and both are clear that your data is your responsibility. Microsoft’s shared responsibility model states that “for all cloud deployment types, you own your data and identities,” and lists data, endpoints, accounts and access management among the responsibilities you always retain — including in software as a service, which is what Microsoft 365 is.
What the suites give you are deletion windows: a period during which something you deleted can be brought back. They are genuinely useful and frequently sufficient for “I deleted it this morning.” They are not point-in-time restore, and they are shorter than most owners assume.
| Situation | Microsoft 365 | Google Workspace |
|---|---|---|
| Deleted file | 93 days, spanning the first- and second-stage recycle bins | 30 days in trash, then permanently deleted automatically |
| File the user purged from the bin | Still within the 93 days unless the recycle bin is emptied | Admin can recover within 25 days of the trash being emptied |
| Permanently deleted email | 14 days by default, configurable to a maximum of 30 | Vault retention rules can hold messages (Business Plus and up) |
| Deleted user account | OneDrive retained 30 days by default, then 93 days in the site collection recycle bin | Account and data restorable up to 20 days after deletion |
Two things follow. First, a silent problem that surfaces after those windows close is unrecoverable — and corruption, bad sync and quiet deletions routinely take longer than 30 days to notice. Second, both vendors sell or licence the gap. Microsoft offers Microsoft 365 Backup as a separate, consumption-billed product covering SharePoint, OneDrive and Exchange Online, with a recovery window you set at 3 months, 6 months, 1 year or 2 years, restore points every 10 minutes for the prior two weeks, and weekly snapshots after that. Google offers Vault to retain, archive and search data from Business Plus up — which is retention and eDiscovery, a different job from restoring a site to how it looked last Tuesday.
RPO and RTO in plain language
These two numbers decide what you should buy, and they’re simpler than the acronyms suggest. Microsoft defines them cleanly:
- Recovery point objective (RPO) is “the maximum duration of acceptable data loss,” measured in time — “30 minutes of data” or “four hours of data.” In practice: how much work are you willing to redo?
- Recovery time objective (RTO) is “the maximum duration of acceptable downtime,” also measured in time, such as “eight hours of downtime.” In practice: how long can you be closed?
Set them per system, not for the business as a whole. A Vancouver dental clinic might accept a four-hour RPO on its marketing folder and demand fifteen minutes on its practice management database. A Surrey distributor might tolerate a day without the shared drive but not an hour without the order system.
Microsoft makes the connection that people miss: your RPO has to line up with how often the backup actually runs, and your RTO has to account for how long a restore takes — which you only know by having done one. A nightly backup means your RPO is a day, whatever you wrote on the plan.
Write both numbers down beside each system, then compare them with what you have. The gap is your shopping list, and it’s usually smaller and cheaper than a general upgrade.
Restore testing: how often, and what a real test looks like
The Cyber Centre says to test the recovery process on a routine basis, and its ransomware playbook is specific: test on a regular schedule such as monthly, and scan a backup for malware before restoring from it. Microsoft puts the consequence plainly — if you haven’t tested your recovery processes in a simulation, you’re more likely to face major problems when you need them for real.
A monthly test that takes twenty minutes:
- Pick a file or folder at random from a backup at least a month old, not last night’s.
- Restore it to a separate location, not over the live copy.
- Open it. Confirm it’s the right version and not empty or corrupt.
- Record the date, what you restored, how long it took and who did it.
An annual rehearsal, which is the one that finds the real problems:
- Pick a scenario — the server is encrypted, or the office is inaccessible for a week.
- Restore a complete system, not a file, to somewhere it can run.
- Time it end to end and compare the result against your written RTO.
- Include the people: can staff reach the recovery contact list, the insurer, the bank and the plan itself while the systems are down?
- Write down what broke and fix it. Something always breaks; that’s the value.
Keep those records. They’re also the evidence a cyber insurer asks for — see our guide to what insurers ask BC small businesses.
What ransomware changes
Ransomware attacks backups on purpose, because a business with working backups doesn’t pay. That changes three design decisions.
Separation. A backup drive permanently connected to the server it protects is part of the server. So is a backup service that your everyday administrator account can delete. Keep two or more copies offline, as the Cyber Centre’s playbook recommends, and use separate credentials with multifactor authentication for the backup system.
Depth. Attackers often sit in a network for a while before triggering encryption, so the last few backups may already contain the problem. Retention measured in months, with multiple recovery points, is what lets you reach back past the intrusion. Scan a backup for malware before restoring it.
Order of operations. Restoring into a compromised network re-infects you. The sequence is contain, investigate, rebuild clean, then restore — which is slower than people expect and belongs in your RTO. Microsoft’s own backup product exists for exactly this scenario: getting a business back to a healthy state after ransomware encrypts large volumes of data, or after accidental or malicious deletion.
The rest of the defence — MFA, patching, endpoint protection, email filtering, training — is what stops you needing the backups. Our small business cybersecurity checklist follows the Cyber Centre’s 13 baseline controls in order.
Floods, earthquakes and why off-site copies matter here
“Off site” can sound theoretical until you’ve watched it matter locally. In November 2021, as the Province puts it, “an atmospheric river brought an unprecedented amount of rain to the province just as winter was beginning.” BC declared a provincial state of emergency on November 17, 2021, to mitigate impacts on transportation networks and the movement of essential goods, and to support response and recovery from widespread damage caused by severe flooding and landslides. Highways 1, 3, 5, 7, 8, 11, 19 and 99 were all damaged, cutting off main access routes to several areas of the province.
For a business in Abbotsford, Chilliwack or Mission, the practical lesson wasn’t only water in the building. It was that for days you could not get to the building, and in some cases could not drive between the Fraser Valley and Greater Vancouver at all. A backup drive locked in an office you can’t reach is not an off-site copy.
Earthquake planning points the same way, on a longer horizon. The Province’s PreparedBC guide for small businesses asks which procedures, systems and equipment are absolutely necessary for ongoing operation, what you’ll do if your building isn’t accessible, and whether you could run from another location. On data it is blunt: “Protect your data on business computers. Perform regular backups and store critical information offsite on USB sticks, in cloud storage or as printed copies.” Its emergency supplies list includes copies of important documents and backup data. It also suggests registering for the Great British Columbia ShakeOut, the province’s annual earthquake drill — a reasonable date to anchor your annual recovery rehearsal to.
One more piece of PreparedBC advice worth acting on: find out what records your insurance provider will want to see after an emergency, and store them somewhere safe.
A recovery plan you can actually follow
A small business plan should fit on a few printed pages. Long plans don’t get read, and they certainly don’t get read during an incident. Cover these:
- Critical functions. The three to five things the business must keep doing — taking orders, paying staff, dispatching crews — and the systems each one needs.
- RPO and RTO per system, written down and agreed by an owner, not by IT alone.
- Who does what. Names and phone numbers for the decision-maker, the technical lead and a backup for each, since people are away or affected too.
- Outside contacts. IT provider, insurer and policy number, bank, landlord, key clients, suppliers, and the privacy or legal advice you’d need.
- Where the data is. Each system, where its backups live, who can restore them and how they authenticate.
- Working without systems. The manual fallback for a day or two — paper orders, a phone list, a way to take payment.
- Alternate location. Where people work if the office is unreachable, and what they need to get going there.
- Communications. What you tell staff, clients and suppliers, who says it, and through which channel if email is down.
- Reporting. Privacy breach steps and cyber incident reporting, so nobody has to research it under pressure.
Print it, keep a copy off site, put the date and version on the front page, and review it once a year. A plan stored only in the system you’ve just lost is not a plan.
The printable backup and recovery checklist
Backup and disaster recovery checklist
- List every system that holds business data, including cloud services, phones and anything on a home computer.
- Name the critical functions the business must keep doing, and which systems each one needs.
- Write an RPO and an RTO beside each system, agreed by an owner.
- Confirm you have 3 copies of important data, on 2 media types, with 1 copy off site.
- Keep at least one copy offline or immutable, out of reach of your everyday admin account.
- Protect the backup system with separate credentials and multifactor authentication.
- Encrypt backups and limit access to the people who perform restores.
- Check the retention depth: how far back can you actually reach, in months?
- Close the cloud gap — decide whether recycle bin windows are enough, or whether you need a backup product.
- Restore something every month, to a separate location, and record the date and duration.
- Rehearse a full recovery once a year, including the people and the phone calls.
- Scan a backup for malware before restoring from it.
- Write the recovery plan, print it, store a copy off site, and date it.
- Keep the insurer’s contact details, policy number and required records somewhere reachable when systems are down.
- Review the whole thing yearly, and after any move, new system or change of provider.
YVR Technology designs, runs and tests backup and recovery for businesses across Greater Vancouver and the Fraser Valley. See our cybersecurity, cloud services and networks and servers pages, or get in touch to review what you have.