What Should a Small Business Back Up, and How?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Back up every record your business can’t run without: legal papers, money records, customer records, your website, domain details, contracts, and procedures. Keep at least one copy that is not connected to your network or main accounts, assign one person to own the schedule, and check that backups actually ran. The Federal Trade Commission (FTC) tells small businesses to back up regularly and keep backups off the network.

Why it matters

Ransomware, theft, fire, a dead laptop, a canceled software subscription, or a vendor going out of business can all erase records. The Cybersecurity and Infrastructure Security Agency (CISA) lists keeping backups as one of its basic steps for small businesses. Many records also have to be kept for years by law (see 9.8.2 Record Retention Periods), so losing them can cause tax and legal trouble too.

A common rule of thumb among IT (information technology) professionals is “3-2-1”: three copies of your data, on two different kinds of storage, with one copy kept off-site. It’s a helpful starting point, not a legal rule.

What to back up

11.8.1 Formation records

Back up your formation documents, operating agreement or bylaws, ownership ledger, Employer Identification Number (EIN) letter, licenses, and permits. Store scans in business cloud storage and keep originals in a fireproof spot. Common mistake: keeping the only copy in the owner’s email.

11.8.2 Financial records

Back up bookkeeping files, bank statements, tax returns, invoices, receipts, and payroll records. Most bookkeeping software lets you export reports and data. Download year-end reports and statements every year. Common mistake: assuming the bank keeps old statements forever. Many limit how far back you can download.

11.8.3 Customer records

Back up customer lists, job history, signed forms, and photos. Common mistake: customer details living only in one person’s phone.

11.8.4 Website

Back up website content, databases, settings, theme and plugin files, images, and source files. Many hosts make backups, but check how long they keep them and whether you can download a copy. Keep at least one copy outside the hosting account. Common mistake: relying only on the host, then losing the hosting account.

11.8.5 Domain records

Store your registrar name, account owner, renewal date, DNS (Domain Name System) records, and recovery details (see 13.1.2 Registrar Ownership and 13.1.4 DNS Access). Export or screenshot your DNS records so you can rebuild them. Common mistake: no copy of the DNS records, so email breaks after a move.

11.8.6 Contracts

Back up signed contracts, estimates, change orders, warranties, and vendor agreements. Common mistake: signed copies only inside an e-signature tool you might cancel.

11.8.7 Procedures

Back up your standard operating procedures, training materials, checklists, and templates (see 22.1 Writing Standard Operating Procedures). Common mistake: procedures only in one manager’s head or laptop.

12.2.6 Shared files backup

Shared cloud folders sync, so a deleted or encrypted file can be deleted or encrypted everywhere. Use a backup that keeps older versions, and test a restore (see 12.2 Shared Files and 11.8.8 Backup Recovery Test). Common mistake: thinking sync is the same as backup.

13.2.5 Website backups

Back up content, databases, media, and settings on a schedule that matches how often the site changes, and before every major update (see 13.2.7 Website Security Updates). Common mistake: updating plugins without a fresh backup.

Customer record exports

15.9.1 Export schedule

Export customer records from your customer relationship management (CRM) system on a regular schedule, like monthly. Common mistake: never exporting, then losing data when a subscription lapses.

15.9.2 Export owner

Name one person who runs the export and a backup person. Common mistake: “someone” does it, so no one does.

15.9.3 Storage

Save exports to business-controlled storage with limited access (see 11.7.6 Least Privilege Access). Common mistake: exports left in a personal downloads folder.

15.9.4 Encryption

Customer exports often hold sensitive data. Protect them with encryption or a password-protected, access-limited location. Common mistake: emailing the export to yourself.

15.9.5 Restore test

Open a recent export and confirm it’s complete and readable, or test an import into a sandbox. Common mistake: exports that turn out to be missing fields.

15.9.6 Deletion

Delete old exports securely on a set schedule, so copies of customer data don’t pile up (see 9.8.5 Secure Record Destruction). Common mistake: keeping every export forever.

Checking backups

22.8.4 Backup confirmation

As part of your routine security check (see 22.8 Security and Backup Procedure), confirm that scheduled backups ran and finished. Look at the last backup date in each tool. Common mistake: a backup job that quietly failed months ago.

When to get help from a pro

Information technology (IT) specialist: to set up automatic backups, especially for the website and shared files. Web developer or host: to confirm website backup scope and how to restore. Questions to ask:

What exactly is backed up, how often, and for how long?
Is any copy kept offline or in a separate account?
How would we restore the website if the hosting account were lost?

Bill’s note

[Bill: add a short note. For example, a client website that had to be rebuilt because there was no backup outside the host, or how you back up SiteSmarty client sites.]

If you’d rather have this done for you, SiteSmarty builds and manages websites for small businesses.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: what SiteSmarty backs up, where, and how often]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: backup schedule sheet and website backup settings]
[Result so far:]

Questions people ask

How often should a small business back up? The FTC says regularly, as part of routine operations. Match the schedule to how often records change: daily for active systems, monthly for exports, and before every website update.

Where should I store backups? Keep at least one copy that’s not connected to your network or main accounts, like an external drive kept unplugged or a separate cloud account.

Do I need my own website backup if the host makes one? Yes, keep one copy outside the hosting account. If you lose the account, you lose the host’s backups too.

How do I back up my CRM? Export your records on a schedule, store them in a protected business location, and check that the export opens and is complete.

Audit check

Line	Question	Pass looks like	Fail looks like	Evidence to collect
11.8.1 Formation records	Are legal and ownership records backed up?	Scans in business storage, originals secured	Only copy in one email or drawer	Folder listing
11.8.2 Financial records	Are money, tax, and payroll records backed up?	Yearly exports and statements saved	Relying on vendors only	Export folder
11.8.3 Customer records	Are customer records and documents backed up?	Scheduled backup or export	Data on one phone	Backup log
11.8.4 Website	Is there a website backup outside the host?	Recent off-host copy	Host backups only	Backup file with date
11.8.5 Domain records	Are registrar, DNS, and renewal details stored?	DNS export and registrar details saved	No DNS copy	DNS export
11.8.6 Contracts	Are signed contracts backed up?	Copies outside the e-signature tool	Only in one tool	Folder listing
11.8.7 Procedures	Are procedures and templates backed up?	Stored in backed-up business storage	On one laptop	Folder listing
12.2.6 Shared files	Do shared files have versioned backups?	Backup with older versions, restore tested	Sync only	Backup settings
13.2.5 Website backups	Are content, databases, media, and settings backed up on schedule?	Scheduled and pre-update backups	No schedule	Backup history
15.9.1 Export schedule	Are CRM exports run on a schedule?	Dated exports on schedule	No exports	Export folder
15.9.2 Export owner	Is someone named to run exports?	Named owner and backup	No owner	Procedure doc
15.9.3 Storage	Are exports in controlled storage?	Limited-access business folder	Personal downloads	Folder permissions
15.9.4 Encryption	Are sensitive exports protected?	Encrypted or locked location	Emailed or open	Storage settings
15.9.5 Restore test	Have exports been checked for completeness?	Dated test note	Never opened	Test log
15.9.6 Deletion	Are old exports deleted securely on schedule?	Retention rule followed	Years of exports piling up	Deletion log
22.8.4 Backup confirmation	Are scheduled backups confirmed in routine checks?	Last backup dates checked and logged	Failed jobs unnoticed	Checklist with dates

Where this fits

Do this first: 11.7.8 Emergency Account Access, 11.5 Data Map, 9.8.3 Record Storage and Access

Do this next: 11.8.8 Backup Recovery Test

Sources

Federal Trade Commission, "Cybersecurity for Small Business" fact sheets (checked October 17, 2026)
Cybersecurity and Infrastructure Security Agency, "CISA Releases Cyber Essentials for Small Businesses and Governments" (checked October 17, 2026)
Cybersecurity and Infrastructure Security Agency, "I've Been Hit By Ransomware!" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.