Data Backup Plan for Small Business: 3-2-1 on One Page

A data backup plan is a one-page table with four columns, and most small businesses have filled in only part of one. The columns are what you back up, where each copy lives, who restores it and how fast, and the date a restore was last proven to work. A backup product fills in part of column two. The plan is the other three, and the plan is what decides whether a stolen laptop or a locked-up server is a bad afternoon or a bad quarter.

The rule behind column two is older than most of the products that sell it. The 3-2-1 strategy, as Backblaze summarizes it, “advises that you keep three copies of your data on two different media with one copy off-site,” and the same post notes that Carnegie Mellon recommended the method in a 2012 paper prepared for US-CERT, a copy of which CISA still hosts (Backblaze; CISA). It is a good rule. It also says nothing about whether anyone in your business can get a copy back, which is why the other three columns exist.

Column one: what you back up, ranked by what it costs to lose

Write the list before you shop. For most small businesses it runs: the bookkeeping file or accounting login, payroll and tax records, the customer list, signed contracts and anything a lawyer would ask for, email, the working files the team opens every day, and whatever runs the website or the booking system. Then sort it by what a week without it would cost, not by file size. The SBA’s emergency guidance names financial, human resources and accounting files as the critical data and suggests weekly cloud backups where possible (SBA).

Retention belongs in this column too, because a backup that deletes versions after 30 days cannot satisfy a rule that counts in years. The IRS says to keep records for 3 years in the general case, for at least 4 years for employment tax records, for 6 years if you under-reported income by more than 25 percent of gross income, and for 7 years for a bad-debt or worthless-securities claim (IRS). Your state, your industry and your insurer may add to that; the IRS page is the floor.

The item owners most often leave off the list is the data that lives inside a cloud app. Your accounting software, your CRM and your email provider store your data; they are not your backup of it. Microsoft sells a separate service for exactly this, Microsoft 365 Backup, at a list price of $0.15 per gigabyte per month of protected content (Microsoft Learn). Google Workspace offers a Data Export tool, but only a super administrator can run it, the export becomes available no earlier than 48 hours after it starts, typically takes 72 hours and can take up to 14 days (Google Workspace). That is a recovery path, not a Friday-afternoon restore. The point was made sharply this year when Manus gave its users a deadline to export their data before deleting it: the export habit is the backup for anything you rent.

Column two: where the three copies live

Copy one is the data where you work on it. Copy two is on a different medium in the same building: an external drive, a small network storage box, or the second computer that holds a synced folder. Copy three is off site, and for a business without a server room that means a cloud backup service. Two media and one off-site copy is the 3-2-1 shape, and the reason for the off-site copy is not only fire. CISA’s ransomware guide tells organizations to “Maintain offline, encrypted backups of critical data,” explains that many ransomware strains hunt for any backup they can reach and encrypt or delete it, and notes that some cloud vendors offer immutable storage while warning that immutable storage “does not meet compliance criteria for certain regulations” (CISA). An external drive that stays plugged in is a second copy; it is not an offline one.

The local copy got more expensive this year, which matters for column two only if you keep tens of terabytes: hard drive prices rose 46 percent in four months with no shortage behind the increase (TechPowerUp), while per-computer cloud backup barely moved. For the off-site copy, three services cover the range, with prices read from each vendor’s pricing page on October 15, 2026:

• Backblaze Computer Backup backs up one computer with no storage limit for $9 a month, $99 a year, or $7.88 a month on a two-year term; a Business tier at the same $99 a year adds multiple users and administrative controls (Backblaze).
• IDrive prices by storage rather than by machine. The Team plan covers five computers and five users with 5 TB for $11.99 a month, or $9.99 a month billed yearly with the first year discounted to $6.99. The Business plan, for unlimited users plus servers and network drives, starts at 500 GB for $19.99 a month billed yearly, $13.99 in the first year (IDrive).
• Carbonite Basic covers one computer for $6.40 a month or $76.79 a year on its current promotion (regular $95.99), and the Plus plan adds one external hard drive for $7.15 a month or $85.79 a year (Carbonite).

A labeled hypothetical to show the arithmetic: a three-person bookkeeping office with two laptops and a desktop that holds the client files. Backblaze on all three machines is $297 a year; IDrive Team on the yearly plan is $119.88 a year at the regular rate, $83.88 in the discounted first year, and covers all three plus two spare seats. The desktop’s client folder also copies nightly to an external drive that gets unplugged after the copy. That is three copies, two media, one off site, and one of the three is offline. The money is not the hard part. The hard part is the next column.

Column three: who restores it, and how fast

The federal contingency planning guide, NIST SP 800-34 Rev. 1, builds recovery planning around two questions: how long a system can be down, and how much recent data the business can afford to lose (NIST). A small business can borrow both questions without the paperwork. For each row in column one, write a person’s name, not a role, and a target in hours. “Bookkeeping file, Maria, back by the next business morning” is a plan line. “IT handles backups” is not.

Under the name, write where the restore instructions are and where the encryption key is. Several backup services let you set a private key that the vendor never holds; if you use one, a backup nobody can decrypt restores nothing, so the key’s location is part of the plan. The instructions should be short enough that the second-most-technical person in the business could follow them with the owner on a plane. That is the test of the whole document, and it is also what makes the plan a safety net for the staff rather than a chore for them: a restore that only the owner can perform is a single point of failure wearing a person’s face.

This is the column an AI assistant helps with most. Paste the column-one list into Claude or ChatGPT and ask it to draft the restore steps for each row in plain language, then correct what it gets wrong about your actual products, because it will guess. Claude’s Free plan costs nothing and Pro is $20 a month or $17 a month billed annually (Claude). If you would rather start from a structured prompt, the Data Backup & Recovery Plan prompt at BusinessPrompter.com is filed under Operations & Systems and promises “data backup and disaster recovery plans to protect business continuity.” It is a Pro prompt behind an upgrade wall, so we have not read the prompt text, and its About panel currently describes a financial compliance strategy rather than a backup plan, which looks like a page description attached to the wrong prompt. Check the chain steps against the four columns here before you rely on it.

Column four: the date it last restored

Everything above is belief until this column has a date in it. CISA’s guide says to “regularly test the availability and integrity of backups in a disaster recovery scenario” (CISA), and the SBA says to practice your plan with your staff (SBA). The test does not need a scenario. Pick one real file that changed more than 30 days ago, ask the backup for the version from before the change, and time how long it takes the named person to get it open. If the answer is “the drive only keeps the latest copy,” you have learned something that no vendor page would have told you. We laid out the day-before-the-drill restore in the continuity testing plan; this is the same check, done on a schedule instead of before an event.

A filled-in plan for the hypothetical office above would look like this, dates included, because an empty fourth column is the whole point:

The third row is the honest one. The office pays for email backup and has never asked for a message back, so the row says so, and “Never” is a task with a date next week rather than a secret.

Our take

Backup is sold as a product and bought as a feeling, and the feeling is the problem. Of the four columns, the one you can buy is the cheapest, and the one that protects you is the one nobody sells: a date, next to a name, proving a real file came back. We would also push harder on the offline copy than the vendors do. Cloud backup with a private key and version history is excellent, and it is still a copy that a stolen password can reach. A drive that is unplugged is not. Keep the retention rules from column one in view before you trim anything to save on storage, and do not delete old copies to make room until the test in column four has passed on what remains.

If you take one sentence from this to whoever sells or manages your backup, make it this one: “Show me the restore of a file we deleted 40 days ago, and tell me who in our office could do it without you.”